Retrogradation method of internal connection meter of fire wall chip

Abstract

The invention discloses an aging method for a connecting table in a firewall chip. The 'assess bit' of each tablebody in the connecting table is used as an access flag bit; after receiving a message, the firewall chip finds out the connecting table according to the five-tuple array of the message; if certain tablebody in the connecting table is hit, an access flag is placed at the 'access bit' of the tablebody; a CPU maintains a timer for each tablebody of the connecting table, for examining the 'access bit' of each tablebody at regular time; if the 'access bit' has the access flag, the access flag of the 'access bit' is eliminated; if the 'access bit' does not have the access flag, the connecting tablebody is deleted. The invention uses the CPU to maintain the timer of each tablebody and establishes access flag bit for each tablebody in the connecting table for the examination of the CPU, and realizes reasonable aging of the connecting table in the firewall chip by the coorporative work of the firewall chip and the CPU.

Description

Aging Method of Internal Connection Table of Firewall Chip technical field The invention belongs to the field of network technology, relates to network security and networking technology, in particular to a method for maintaining the internal connection table of a firewall chip. Background technique With the continuous development of network technology, people have higher and higher requirements for network response speed, data packet throughput and network security, and a security firewall with small delay and large traffic is required. This requires a chip to achieve hardware acceleration and improve the performance of the firewall. At present, most data packets on the Ethernet network (Ethernet) are transmission control protocol packets (TCP packets) and user datagram protocol packets (UDP packets). These data packets are grouped according to connections, and the same group of TCP packets or UDP packets has the same 5-tuple of data packets, that is, source IP, destinat...

Images