A method of MAC address learning based on software and hardware cooperation in vpls

Abstract

The invention discloses a method for learning MAC addresses based on software and hardware cooperation in VPLS, comprising: receiving a message, analyzing and obtaining a source MAC address and a virtual switching instance to which it belongs; obtaining the MAC address table if there is an address learning request to access the MAC address table The entry information in the arbitration pre-learning entry information and the entry information in the MAC address table; if the MAC address authentication is enabled, the entry status will be updated to pre-authentication and the aging period will be 1 / 2 of the preset aging period, the arbitration list length status; if not activated For MAC address authentication, update the entry status to pass the authentication and update to the preset aging period; if there is no address learning request but there is a CPU request to access the MAC address table, when the entry status is valid and the entry information matches, perform corresponding operations on the pre-authentication entry status . The invention prevents attackers from forging a large number of legal MAC addresses to occupy normal MAC address table resources for a long time, prevents the CPU from being overloaded, and maintains the normal operation of the network and other services.

Description

technical field [0001] The present invention relates to the field of network communication, in particular to a method for learning MAC (Media Access Control, medium access control) addresses based on software and hardware cooperation in VPLS (Virtual Private Lan Service, virtual private local area network service). Background technique [0002] VPLS is a technology that provides virtual Ethernet services on a wide area network. It provides a multipoint-to-multipoint VPN (Virtual Private Network, virtual private network) networking mode to realize the interconnection between LAN sites across the wide area network. A typical VPLS network includes CE (Custom Edge, user edge device) and PE (Provider Edge, operator edge device), among which CE is connected to PE through AC (Attachment Circuit, access link), and between PE Establish a public network tunnel. Then, create a VSI (Visual Switch Instance, virtual switch instance) on each PE and configure a PW (Pseudo Wire, pseudowire)...

AI Technical Summary

Problems solved by technology

[0007] The technical problem to be solved by the present invention is that the attacker forges a large number of legal MAC addresses, causing the CPU to frequently process the authentication request message of the MAC address, causing the CPU to be overloaded. MAC addresses occupy normal MAC address table resources for a long time, causing the MAC address table to overflow and affecting packet forwarding of legitimate users.

Images