Multi-line card high-density TAP switch based on FPGAs

Abstract

The invention discloses a multi-line card high-density TAP switch based on FPGAs. The multi-line card high-density TAP switch comprises a plurality of line card modules, a high-speed serial backboard,a master control module and a switch module. The line card modules receive data streams of network side interfaces, identify protocol information of the data streams, send the data streams of the network side interfaces to the switch module, receive the data streams sent by the switch module, and send the processed data streams and the data streams uploaded by the switch module to tool side interfaces. The switch module realizes data and control information switch among the line card modules, and between the line card modules and the master control module, identifies and processes the received data streams of the network side interfaces, and sends the processed data streams to the line card modules according to a TAP switch policy customized by a user. The master control module realizes control and state monitoring of a complete machine, issues control and configuration instructions to the line card modules through the switch module, and collects state information of the line card modules and the switch module.

Description

Technical field [0001] The invention relates to an FPGA-based multi-line card high-density TAP switch. Background technique [0002] TAP switch, also known as Ethernet splitter or network monitoring switch, is an intelligent processing device for Ethernet network traffic. Its ports can be set as network-side interfaces and tool-side interfaces. The network-side interface is used to obtain the original network After the data is processed by the TAP, it is sent to the tool-side interface, which is used to connect to the network security tool. The TAP switch can perform functions such as data replication, aggregation, and load balancing without interrupting the normal network traffic. At the same time, it can filter the traffic to improve the compatibility and scalability of network security tools. Therefore, TAP switches are important supporting equipment for obtaining network traffic and optimizing the performance of network security tools in security solutions such as IP network...

AI Technical Summary

Problems solved by technology

[0007] The TAP switch based on the PHY chip, because the function of the PHY chip is relatively single, only the PHY interface of the same rate can transmit data, and the data exchange between high-density ports cannot be realized, so it is not suitable for large-scale high-density networks such as data centers. Security Monitoring

[0008] TAP switches based on NPU, on the one hand, high-performance NPUs are more expensive, so the cost of TAP switches based on NPU is higher; on the other hand, because the data processing inside the NPU is processed by software, the forwarding and processing time delay It is large and difficult to control accurately. In financial and other application scenarios that require high real-time performance, it cannot meet the requirements of low latency.

[0009] The TAP switch based on Switch requires high-performance Switch chips, but the processing speed and analysis depth of network traffic are insufficient. Since the data processing of Switch chips is concentrated on the link layer, network layer, and transport layer, it cannot analyze the network traffic. The application layer of the data stream performs in-depth identification and filtering processing

[0010] To sum up, the TAP switches in the prior art are insufficient in the number of ports and data processing depth, and cannot meet the security monitoring requirements of large-scale high-density networks such as data centers. For how to increase the data processing depth of TAP and increase the number of ports, To meet the application requirements of high-density networks, there is still a lack of effective solutions

Images