JPH08223203A - Network relay device - Google Patents

Abstract

(57) [Abstract] [Purpose] To improve the relay performance of a network relay device. [Structure] A plurality of input / output ports 101 and 102 are provided and a function of relaying data from one input / output port to another input / output port, a filter database 108 by which a user specifies the type of received data, a specified reception A network relay device 100 including a function of restricting relay of data and a processor 107 that executes these processes, and temporarily stores communication control information of received communication data and restriction of communication data. The processor 107 includes the storage memory 109, and when receiving the communication data including the stored communication control information, the processor 107 executes a process according to the stored limiting condition.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION The present invention has a plurality of input / output ports and a function of relaying information between the ports.
The present invention relates to a network relay device that transmits in frame units.

[0002]

2. Description of the Related Art As a network relay device, a MAC (Medium Access Control) bridge defined by IEEE802.1d of the Institute of Electrical and Electronics Engineers of Japan is widely known. The MAC bridge defined in this standard has a plurality of input / output ports, and can receive a MAC frame or transmit a MAC frame through the input / output ports. The plurality of input / output ports are respectively connected to different networks, and the MAC bridge transmits the MAC frame received via a certain port to the network connected to the end of the port via another port. Such an operation is called frame relay.

Next, referring to the drawings, a conventional MAC
An operation example of the bridge will be described. FIG. 9 is a connection diagram showing a configuration of a network system using a MAC bridge. The MAC bridge 901 has a network 90
2, 903 are connected. Computers 904 and 905 are connected to the network 902, and computers 906 and 907 are connected to the network 903.

In such a configuration, for example, the computer 904 of the network 902 and the network 90
When information is exchanged with the third computer 907, information is exchanged via the MAC bridge 901 by a group of transmission units called a frame 908. FIG. 10 shows a configuration example of a frame in Ethernet. The frame has a destination address (DA: Destination address) 1001 arranged at the head and a source address (SA: Source ad) transmitted after this address.
dres) 1002, upper protocol (TYPE) 1003
And communication control information, and user data (DATA) 10
It is composed of 04.

Next, the relay operation of the MAC bridge 901 will be described. When transmitting data from the computer 907 to the computer 904, first, the computer 9
07, the communication control information is added to the data to be sent to form a frame 908, which is sent to the network 903 through the output port. The computer 906 and the MAC bridge 901 connected to the network 903
If frame 908 is not specified to be discarded, frame 908 is relayed to network 902.
The computer 906 receives the frame 908, but discards the frame 908 because the destination address is not its own station.

MAC bridge 901 is network 90
The frame 908 transmitted to No. 2 is received by the computers 904 and 905. The computer 905 receives the frame 908, but discards the frame 908 because the destination address is not its own station. Computer 90
In 4, the destination address is the own station,
The user data in 08 is taken out and received. Thus, from the perspective of the computer 907, the transmitted data passes through the MAC bridge 901 and
It seems to reach.

Further, a filter function is implemented in many MAC bridges. This function is a function for preventing a frame received at one port of the MAC bridge from being transmitted to another port of the bridge. The filtering function is performed to avoid unnecessary relaying of frames to the network. The process of determining whether to relay or discard the received frame is based on information called a filter database.

Next, the operation of the filter processing using the conventional technique will be described with reference to the drawings. FIG. 11 is a block diagram showing the configuration of a MAC bridge in a conventional network relay device. Further, FIG. 12 is a filter database configured in the memory of the MAC bridge.
Furthermore, a computer 90 connected to each network
A MAC address is assigned to each of 4, 905, 906, and 907. For example, as shown in FIG.
Each computer name corresponds to the hexadecimal MAC address information.

As shown in FIG. 11, the MAC bridge 90
Reference numeral 1 denotes an input / output port (1) 1101 connected to the network 902, an input / output port (2) 1102 connected to the network 903, and an input / output port (1) 1101.
LAN connection circuit (1) 1103 connected to the I / O port, and LAN connection circuit (2) connected to the input / output port (2) 1102
1104, a bus 405 connected to the LAN connection circuits 1103 and 1104, a frame storage memory 1106 connected to the bus 405, a processor 1107, and a filter database 1108.

In the configuration of FIG. 11, the input / output port 11
The operation when 01 receives a frame will be described. The signal of the frame received at the input / output port 1101 is processed by the processor 110 in the LAN connection circuit 1103
7 is converted into a data format that can be processed and recorded in the frame storage memory 1106. The destination address, the source address, and the upper protocol value of the frame recorded in the frame storage memory 1106 are compared with the source address, the destination address, and the upper protocol value recorded in the filter database 1108, and designated. If it is included in the range, the relaying or discarding process is performed according to the designated content.

When the discard process is designated, the corresponding frame is deleted from the frame storage memory 1106.
On the other hand, when the relay process is designated, the frame is transmitted to the LAN connection circuit 1104. LAN connection circuit 110
4 converts the frame into a signal, and transmits the signal to the network 903 via the input / output port 1102. Then MAC
When relaying by the bridge 901, the IEEE 802.
Processing when an abnormal frame is received, such as longer than the maximum length of the frame specified in 3, 802.4 and IEEE802.5, or an error in the frame check sequence (processing to discard without relaying) Will be described.

The signal of the frame 908 received at the input / output port 1101 is converted by the LAN connection circuit 1103 into a data format that can be processed by the processor 1107, and recorded in the frame storage memory 1106. By referring to the frame length value and the frame check sequence value recorded in the frame storage memory 1106, it is checked whether or not the actually received frame is the same as that value, and if it is different from the memory content, it is destroyed in the lower layer. It is considered that the data has been transmitted and is deleted from the frame storage memory 1106 without being relayed. On the other hand, if the frame 908 is normal, the frame 90
8 is sent to the LAN connection circuit 1104. The LAN connection circuit 1104 converts the frame 908 into a signal and transmits it to the network 903 via the input / output port 1102.

[0013]

However, in the above-mentioned prior art, when the condition for relaying or discarding a frame, that is, the number registered in the filter database is large, the information in the frame and the filter database Since it is necessary to collate all of the values and to compare the values, it takes a long time to make a determination for determining relaying or discarding. If this process takes a long time, it becomes a factor that delays the relay of the frame, which deteriorates the network performance.

That is, in recent years, the performance of computers has been improved, and the amount of data transmitted and received between computers using a network has been increased from several thousand bytes to several million bytes. On the other hand, as a small-scale network system,
In the case of the most popular Ethernet, the maximum frame size is specified as 1500 bytes. For this reason, when transferring a large amount of data, it is necessary to divide the data into pieces and send the pieces. As described above, when a large amount of data is transferred between two computers, a large number of frames having the same communication control information section are generated. When two computers are connected via a network relay device, the network relay device refers to the filter database and executes the comparison process each time a frame having the same communication control information section is received. If the filter data becomes huge, the comparison process will take time, resulting in a relay delay.

Further, in the IEEE 802, an address in which all bits of an address for identifying each device are "1" is reserved as a "broadcast address" for sending to all nodes at the same time. A frame having a destination address of a broadcast address is called a broadcast frame, and all devices connected to the network must receive and process the same as the frame addressed to the own station. For example, the broadcast address is used for inquiring a station whose address is unknown or for notifying all stations connected to the network of information regarding the relay route.

A broadcast frame may be continuously transmitted due to a failure of a device connected to the network. Further, if the broadcast address is erroneously set in the network device, all the responses to the frames transmitted by the device become the broadcast frame, and the broadcast frame may occur at a high frequency. MA defined by IEEE802.1d
Even if the broadcast frame is received at an abnormal frequency, the C-bridge relays it if the frame itself is normal. Therefore, the device fails in the network system connected by the MAC bridge, and the broadcast frame is transmitted. If it occurs frequently, broadcast frames will be propagated to all networks. This broadcast frame is received by all the devices (including the relay device) connected to the network, and causes a failure such as performance degradation of the network (or the connected device is stopped due to overload).

Therefore, an object of the present invention is to provide a network relay device capable of improving the relay performance. Another object of the present invention is to provide a network relay device capable of preventing a decrease in network performance due to frequent occurrence of broadcast frames and a failure due to overload of equipment.

[0018]

In order to achieve the above object, the present invention has a plurality of input / output ports and a function of relaying data from one input / output port to another input / output port. In a network relay device having a database for designating the type of received data and a function for restricting relay of designated received data,
Storage means for temporarily storing the communication control information of the received communication data and restrictions on the communication data, and when the communication data including the communication control information saved by the storage means is received, processing is performed according to the saved restriction conditions. A processing means to execute is provided.

In order to achieve the above-mentioned other objects,
The present invention relates to a network relay device having a plurality of input / output ports, a function of relaying data from one input / output port to another input / output port, and a function of limiting relay of abnormal received data, in a network relay device. Storage device that stores the source address and the number of times of reception of the communication data when the communication data addressed to all devices connected to the device and the number of times of reception from the same source exceeds a preset number. Therefore, it is considered that an abnormality has occurred in the transmission source, and a control means for limiting relay of communication data is provided.

[0020]

According to the above-mentioned means, the communication control information of the received communication data and the restriction for this communication data are temporarily stored, and are stored when the communication data including the communication control information stored thereafter is received. The processing is performed according to the specified restrictions. As a result, the filtering process of the network relay device is performed at high speed.

Further, when the number of receptions from the same transmission source exceeds a preset number, it is considered that an abnormality has occurred in the transmission source, and the frequently-generated broadcast frame is discarded. As a result, it is possible to prevent a decrease in network performance caused by the frequent occurrence of broadcast frames and a failure due to an overload of network equipment.

[0022]

Embodiments of the present invention will be described below with reference to the drawings. [Embodiment 1] FIG. 1 is a block diagram showing an embodiment of a network relay device according to the present invention. 2 is shown in FIG.
3 is a flowchart showing the operation of the embodiment of FIG. Note that, in FIG. 1, the same reference numerals are used for the same components as those shown in FIG. 11, and thus duplicated description will be omitted below.

As shown in FIG. 1, a MAC bridge 100
Is an input / output port (1) 101 connected to the network 902, an input / output port (2) 102 connected to the network 903, a LAN connection circuit (1) 103 connected to the input / output port (1) 101, LAN connection circuit (2) 10 connected to the output port (2) 102
4. Bus 1 connected to LAN connection circuits 103 and 104
05, a frame storage memory 106, a processor 107, a filter database 108, and a temporary storage memory 109 each connected to the bus 105.

As is clear from the comparison with the configuration of FIG.
This embodiment is characterized in that a temporary storage memory 109 is provided. In this configuration, a case where a frame is received by the input / output port 101 connected to the network 902 will be described. A frame signal input by the input / output port 101 is a data that can be processed by the processor 107 in the LAN connection circuit 103. It is converted into a format and stored in the frame storage memory 106.

As shown in FIG. 3, the temporary storage memory 109 is composed of two types of data, list blocks 301, 302, 303 and registration blocks 304, 305, 306, and communication control information is registered in the registration block 304. ，
It is recorded in 305 and 306. Registration block 304,
The addresses of the memories 305 and 306 are the list block 30.
1 is shown. The dotted line shown in FIG. 3 indicates the address of the memory at the starting point indicated by the arrow.

FIG. 4 shows the data structure of the list block. The list block 401 is composed of a memory address 402 where the next list block exists, a 32-bit key 403, and a memory address 404 where the registration block exists. It is a series of data. FIG. 5 shows the data structure of the registration block. The registration block 501 is a series of data including the communication control information section 502 of the received frame and the determination result 503. For example, when the value of the determination result 503 is "1", the relay process is instructed, and when the value is "2", the discard process is instructed.

The list block 401 can form a continuous array by recording the memory address 402 where the next list block exists, even if the list block 401 actually exists in any place in the memory. The last one in the array of the list block 401 stores "0" in the memory address 402 where the next one exists in order to clearly show that it is the last one. The memory address where the list block at the beginning of the array exists is always recorded at a specific address in the memory.

In the network relay device of the present invention, before comparing the frame recorded in the frame storage memory 106 with the data in the filter database 108, the communication control information registered in the temporary storage memory 109 is Search according to the procedure described in. First, when a frame is received (step 201), it is determined whether or not a list block exists (step 202). If the list block exists, the first list block is referred to (step 203), and the first 32 bits of the communication control information of the frame is compared with the key included in the first list block 301 (step 204).

If it is determined that the comparisons do not match,
It is determined whether or not the next list block exists (step 205), and if it exists, the next list block is referred to (step 206), and the process proceeds to step 204. In addition, if a match is determined in step 204, the memory address in which the registration block 304 exists is referenced (step 207) and the communication control information section 502 included in the registration block 304 is compared (step 208).

If it is determined in step 208 that the communication control information portions match, the list block is changed to the beginning of the array (step 209) and the determination result 503 recorded in the registration block is referred to (step 210). ). Then, if the determination result 503 indicates discarding (step 211), the record of the corresponding frame is deleted from the frame storage memory 106 (step 212). On the other hand, when the determination result 503 indicates relay, the frame is LAN
The relay process for sending to the connection circuit 104 is executed (step 213).

On the other hand, the LAN connection circuit 104 converts the frame into a signal and transmits it to the network 903 through the input / output port 102. When the processor 107 searches the registered communication control information and determines that the frame is not registered, it creates a list block and a registration block in the temporary storage memory 109 (steps 214 and 21).
5) Compare the value in the filter database with the value in the communication control information part of the received frame (step 216). The result obtained by this is the created registration block 501.
Is recorded in the determination result 503 (step 217). When the capacity of the temporary storage memory 109 becomes full, the registration block indicated by the address is used as the last list block in the array.

As is clear from the above, according to the above-mentioned embodiment, when the frames having the same communication control information section are continuously received in a short time, all the data in the filter database and the communication control information of the received frame are received. Since the comparison processing of 1 can be omitted, the processing time required for relay can be shortened. [Embodiment 2] FIG. 6 shows a network relay device according to another embodiment of the present invention.

The difference between this embodiment and the above embodiment is that
The temporary storage memory 109 of FIG. 1 is replaced with a source address recording memory 110, and the filter database 108 is replaced with an external timer 111 for measuring the frequency of occurrence of broadcast frames. In this configuration, the frame signal input from the input / output port 101 is converted by the LAN connection circuit 103 into a data format that can be processed by the processor 107, and the frame storage memory 1
It is stored in 06.

FIG. 7 shows the structure of the transmission source address recording memory 110, which has a transmission source address 701 and a reception count 702.
And can be recorded as a set. Also, in FIG.
It is a block diagram which shows the frame structure prescribed | regulated by EEE802.3. The IEEE802.3 frame has a destination address (DA) 801, a source address (SA) 802,
Frame length (LEN: Length field) 803, user data (DATA) 804, frame check sequence (F
CS: Frame Check Sequence) 805.

The processor 107 is the frame storage memory 1
Destination address 801 of the received frame stored in 06
Refer to. If the destination address 801 is a broadcast address, it is confirmed whether or not the source address 802 of the received frame is recorded in the source address recording memory 110. The number of times of forming a group is increased by "1". On the other hand, if the address is not recorded, a new address is registered and the number of times of pairing with the address is set to "1". If the destination address of the received frame is not a broadcast address, it is relayed by a normal method.

The external timer 111 gives an interrupt signal to the processor 107, for example, once every 5 seconds. When the external timer 111 gives an interrupt signal, the processor 107 sets all the values of the number of receptions 702 in the source address recording memory 110 to “0”. If the number of receptions exceeds a certain threshold value (for example, 500), it is determined that broadcast frames frequently occur, and then the broadcast frames from the same source address are discarded.

[0037]

As described above, according to the present invention, the storage means for temporarily storing the communication control information of the received communication data and the restriction on the communication data, and the communication data including the communication control information stored by this storage means. When a message is received, processing means for executing processing according to the stored restriction condition is provided, so that the filtering process of the network relay device is performed at high speed, and a frame having the same communication control information section can be processed in a short time. Even in the case of continuous reception, the comparison processing of all the data in the filter database and the communication control information of the received frame can be omitted, and the processing time required for relay can be shortened.

Further, according to the present invention, when the communication data addressed to all the devices connected to the network are received, a storage means for storing the transmission source address and the number of times of reception of the communication data, and the same transmission source are used. Since it is considered that an error has occurred in the transmission source when the number of times of reception of the data exceeds a preset number, and a control means for limiting the relay of communication data is provided, frequent broadcast frames are generated. It is possible to prevent a decrease in network performance caused by the above and a failure due to an overload of the network device.
In addition, it is possible to reduce the influence of the broadcast frame that frequently occurs.

[Brief description of drawings]

FIG. 1 is a block diagram showing an embodiment of a network relay device according to the present invention.

FIG. 2 is a flowchart showing the operation of the embodiment of FIG.

FIG. 3 is a configuration diagram showing a configuration of a temporary storage memory.

FIG. 4 is an explanatory diagram showing a data structure of a list block.

FIG. 5 is an explanatory diagram showing a data structure of a registration block.

FIG. 6 is a network relay device showing another embodiment of the present invention.

7 is an explanatory diagram showing a configuration of a source address recording memory in FIG.

FIG. 8 is an explanatory diagram showing a frame structure of IEEE802.3.

FIG. 9 is a connection diagram showing a configuration of a network system using a MAC bridge.

FIG. 10 shows a configuration example of a frame in Ethernet.

FIG. 11 is a MAC in a conventional network relay device.
It is a block diagram which shows the structure of a bridge.

FIG. 12 is a filter database configured in the memory of the MAC bridge.

FIG. 13 is an explanatory diagram illustrating an example of MAC address information.

[Explanation of symbols]

 100 MAC Bridge 101, 102 Input / Output Ports 103, 104 LAN Connection Circuit 106 Frame Storage Memory 107 Processor 108 Filter Database 109 Temporary Storage Memory 110 Source Address Recording Memory 111 External Timer 902, 903 Network

Claims (2)

[Claims] 1. A function of providing a plurality of input / output ports and relaying data from one input / output port to another input / output port, a database in which a user designates a type of received data, and a relay for designated received data. In a network relay device equipped with each of the limiting functions, a storage unit for temporarily storing the communication control information of the received communication data and the restriction on the communication data, and communication data including the communication control information stored by the storage unit A network relay device comprising: a processing unit that, when received, executes a process according to a stored restriction condition. 2. A network relay device having a plurality of input / output ports and having a function of relaying data from one input / output port to another input / output port and a function of limiting relay of abnormal received data, When receiving communication data addressed to all devices connected to the network, a storage unit that stores the source address and the number of times of reception of the communication data, and the number of times of reception from the same source is a preset number of times. A network relay device comprising: a control unit that restricts relay of communication data by considering that a transmission source has an abnormality when exceeding the limit.