A fpga-based multi-line card high-density tap switch

Abstract

The invention discloses an FPGA-based multi-line card high-density TAP switch, which includes several line card modules, a high-speed serial backplane, a main control module and a switching module; the line card module receives the data flow of the network side interface, Identify the protocol information of the data flow, send the data flow of the network side interface to the switching module, receive the data flow sent by the switching module, and send the processed data flow and the data flow uploaded by the switching module to the tool side interface; the switching The module implements the exchange of data and control information between line card modules and between the line card module and the main control module, and identifies and processes the received data flow of the network side interface, and processes it according to the TAP exchange strategy customized by the user. The final data stream is sent to the line card module; the main control module realizes the control and status monitoring of the whole machine, sends control and configuration instructions to each line card module through the switch module, and collects the status of each line card module and the switch module information.

Description

technical field [0001] The invention relates to an FPGA-based multi-line card high-density TAP switch. Background technique [0002] The TAP switch, also known as an Ethernet splitter or a network monitoring switch, is an intelligent processing device for Ethernet network traffic. Its ports can be set as network-side interfaces and tool-side interfaces. After the data is processed by the TAP, it is sent to the tool-side interface, which is used to connect to network security tools. The TAP switch can perform functions such as data replication, aggregation, and load balancing without interrupting normal network traffic. At the same time, it can filter traffic to improve the compatibility and scalability of network security tools. Therefore, the TAP switch is an important supporting device for obtaining network traffic and optimizing the performance of network security tools in security solutions such as IP network security monitoring, intrusion detection systems, mobile sign...

AI Technical Summary

Problems solved by technology

[0007] The TAP switch based on the PHY chip, because the function of the PHY chip is relatively single, only the PHY interface of the same rate can transmit data, and the data exchange between high-density ports cannot be realized, so it is not suitable for large-scale high-density networks such as data centers. Security Monitoring

[0008] TAP switches based on NPU, on the one hand, high-performance NPUs are more expensive, so the cost of TAP switches based on NPU is higher; on the other hand, because the data processing inside the NPU is processed by software, the forwarding and processing time delay It is large and difficult to control accurately. In financial and other application scenarios that require high real-time performance, it cannot meet the requirements of low latency.

[0009] The TAP switch based on Switch requires high-performance Switch chips, but the processing speed and analysis depth of network traffic are insufficient. Since the data processing of Switch chips is concentrated on the link layer, network layer, and transport layer, it cannot analyze the network traffic. The application layer of the data stream performs in-depth identification and filtering processing

[0010] To sum up, the TAP switches in the prior art are insufficient in the number of ports and data processing depth, and cannot meet the security monitoring requirements of large-scale high-density networks such as data centers. For how to increase the data processing depth of TAP and increase the number of ports, To meet the application requirements of high-density networks, there is still a lack of effective solutions

Images