An effective solution to the problem of multiple hits in message traffic filtering and diversion platform and implementation method

Abstract

The present invention discloses a flow filtering and diversion platform and implementation method that effectively solves the problem of multiple hits of messages. The hardware form of this platform is an ATCA chassis architecture, which is composed of a backplane, a main control board, a line board, and a switch board. The main control board, the line board, and the switch board are connected to the backplane connector to realize Ethernet communication between the boards. The main control board is responsible for the command control of all boards in the ATCA chassis, and undertakes part of the function of rule management, and the external network management device can be connected to the main control board through the RJ45 Ethernet interface, which is responsible for communicating with the device control network management. This meets the requirements that when a single message matches multiple complex rules at the same time, the diversion filtering action of all rules can be executed, and the diversion filtering rules used are effective at the same time. This solves the problem of multiple hits in flow diversion filtering.

Description

Technical Field

[0001] The present invention relates to a flow filtering and diversion platform in the field of computer communication, and in particular to a flow filtering and diversion platform and an implementation method thereof that effectively solves the problem of multiple hits of messages. Background Art

[0002] In recent years, a large number of high-speed network technologies have emerged. Due to the rapid development of the network, data analysis technologies in the network, such as content filtering, network flow analysis, and protocol analysis, have become increasingly complex. It is very important to study how to filter and divert data in a high-speed network environment. Existing traffic filtering and diversion platforms usually have built-in filtering and diversion modules in the circuit board, and this design has high hardware costs. At the same time, the current problem of the traffic filtering and diversion platform that may hit multiple rules for the same message is mainly based on the priority of the rules or the order in which the rules are issued. The diversion filtering action of the highest priority rule or the diversion filtering action of the earliest issued rule is executed. Therefore, it cannot be guaranteed that all filtering and diversion actions for this message are fully executed, resulting in partial omissions of filtering and diversion actions. Summary of the invention

[0003] In order to solve the problem that the same message hits multiple filtering rules at the same time in the existing filtering and diversion platform and the actions of all rules cannot be executed, the present invention provides an effective solution to the problem of multiple hits of messages. The filtering and diversion platform can not only filter and divert according to the message input port, L2 layer source MAC / destination MAC / VLAN, MPLS label, MPLS domain source MAC / destination MAC / VLAN, L3 layer IP quintuple and other fields and masks or the combination rules of various fields and masks, but also can effectively solve the problem of multiple hits by splitting, reorganizing, sorting and other calculations of the configuration rules, ensuring that all the actions of all rules are correctly executed.

[0004] The technical solution adopted by the present invention is: an effective solution to the multi-hit flow filtering and diversion platform of messages, including a main control board, a line board and a switch board installed in a chassis and connected to a backplane, characterized in that a ZYNQ processor, an FPGA processor, a TCAM chip, a clock module and a power supply module are arranged on the switch board, the ZYNQ processor is connected to the DDR3 memory, and is connected to the EMMC memory and the QSPI memory through an SPI interface respectively, the ZYNQ processor is connected to the connector on the backplane through an RGMII network port, the ZYNQ processor is connected to the FPGA processor through a SELECTMAP interface and a CHIP2CHIP interface respectively, the ZYNQ processor is connected to the clock module and the power supply module through an I2C interface respectively, the ZYNQ processor is connected to the running status indicator through a GPIO interface, the ZYNQ processor is connected to an RJ45 Ethernet debugging interface through an RGMII interface, and the ZYNQ processor is connected to a serial port debugging port through a UART interface; the FPGA processor is connected to two 40G QSFP28 optical module interfaces and 12 10G SFP+ optical module interface,FPGA ​​processor is connected to TCAM chip through Interlake interface.

[0005] A method for effectively solving the problem of multiple hits of messages on a traffic filtering and diversion platform, characterized in that the method comprises the following steps:

[0006] 1. The main control board receives and sends communication commands from the network management through the RJ45 Ethernet interface. After receiving the network management command, the main control board parses and processes the network management command, and communicates management data with the line board and switch board through the backplane according to the business process.

[0007] 2. The line card has 28 1G SFP+ optical module interfaces and 4 10G SFP+ optical module interfaces, which are responsible for receiving and sending L2 Ethernet optical signal traffic; the line card aggregates the received L2 layer message data through the QSFP28 optical module interface to the switch card for processing.

[0008] 3. The switch card receives the data traffic aggregated from the line card through a QSFP28 optical module interface, and sends the filtered data back to the line card through this QSFP28 optical module interface; the switch card is responsible for receiving the L3 Ethernet optical signal flow and sending the L3 filtered optical signal traffic through another QSFP28 optical module interface.

[0009] 4. After the ZYNQ processor on the switch board receives the user rule addition and deletion configuration commands from the main control board through the backplane, it parses the configuration commands, splits and reorganizes the user rules, and converts the user rules into the internal rule format. The ZYNQ processor on the switch board completes the rule sorting calculation and sends the re-sorted rules to the FPGA processor through the CHIP2CHIP interface.

[0010] 5. After receiving the network data traffic, the FPGA processor parses and performs diversion and filtering processing on the message through the management TCAM module according to the rule configuration issued by the switch board ZYNQ processor.

[0011] 6. After completing the rule sorting calculation, the ZYNQ processor on the switch board stores the updated rules in the rule management library.

[0012] 7. When the ZYNQ processor on the switch board receives the query rule command from the main control board, it queries the rules in the rule management library and the relationship between these rules. The ZYNQ processor converts the internal rules of the device into user rules based on the relationship between the rules, and reports the query results to the main control board through the backplane network port. The main control board reports the query results to the user through the network management.

[0013] In step 4 of the present invention, the rule sorting calculation has the following operation steps:

[0014] Traverse the rule management library and compare the relationship between each rule in the current newly added rule and the original rule:

[0015] (a) When comparing the currently added rules to the original rules, update the filter output port, update the rule relationship table, and continue to compare the added rules with the rules behind the rule management library.

[0016] (b) When the newly added rule is compared to the original rule and is equal, the filter output port is updated, the rule relationship table is updated, and the rule is added.

[0017] (c) When comparing the current newly added rules to be included in the original rules, update the filter output port, update the rule relationship table, and insert the newly added rules before the original rules in the rule management library.

[0018] (d) When comparing the intersection of the current newly added rules and the original rules, find the intersection of the two rules and generate new rules. Compare the generated new rules with each of the original rules to determine whether there are identical rules. If there are identical rules, directly update the filter output port number of the identical rules. If there are no identical rules, put the new rule intersection and the newly generated rule directly into the rule management library before the current original rule, and continue to compare and calculate the newly added rules with the subsequent original rules in the rule management library.

[0019] (e) When the currently added rule is found to be irrelevant to the original rule, the currently added rule is inserted at the end of the rule management library.

[0020] In step 5 of the present invention, the message parsing and flow filtering process has the following steps:

[0021] (1) The FPGA processor extracts the packet fields and sends them to the TCAM chip. The TCAM chip searches for the packet header information of each received message packet and performs Layer 2 rule filtering.

[0022] (2) The TCAM chip performs a header information matching search on the message data packets filtered by the Layer 2 rules, and the FPGA processor caches the TCAM search results. The FPGA decides whether to continue forwarding or discarding the message based on the TCAM search results.

[0023] (3) The FPGA then determines whether to perform Layer 3 rule filtering. If so, it adds an L2ID tag and sends it to the TCAM chip to perform Layer 3 rule filtering.

[0024] (4) The TCAM chip will perform a Layer 3 rule header information match search and return the search results to the FPGA processor cache. The FPGA will decide whether to continue forwarding or discard the message based on the TCAM search results.

[0025] (5) If the message needs to be forwarded further, the FPGA processor sends the data message to the destination output port according to the filtering rules, and the message parsing and diversion filtering process ends.

[0026] The beneficial effects of the present invention are as follows: the line card of the present invention is responsible for receiving and sending L2 layer optical network signal traffic that needs to be filtered, and the data traffic of the line card optical network signal is aggregated to the switch card through the 40G QSFP28 module for unified filtering and processing, and the line card is no longer built with a filtering and diversion module. This design not only saves the platform hardware cost, but also fully considers the subsequent expansion of the platform's bandwidth for L2 filtering and diversion traffic.

[0027] This design can meet the requirements of different traffic packets based on input ports, L2 layer source MAC / destination MAC / VLAN, MPLS labels, MPLS domain source MAC / destination MAC / VLAN, L3 layer IP quintuple fields and masks, or the combination of fields and masks, and the application scenarios where all rules are effective at the same time for those rules without coupling relationships. It can also effectively solve the problem that rules with coupling relationships cannot be effective at the same time through rule splitting and reorganization calculation, thereby meeting the requirements that all rules can be executed for diversion filtering actions when a single message matches multiple complex rules at the same time, and all diversion filtering rules are effective at the same time. This solves the problem of multiple hits in traffic diversion filtering. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a chassis framework diagram of a flow filtering platform that effectively solves the problem of multiple hits of messages in the present invention;

[0029] Figure 2 This is a principle block diagram of a switching board for a flow filtering platform that effectively solves the problem of multiple hits of messages;

[0030] Figure 3 It is the overall workflow diagram of the present invention;

[0031] Figure 4 is a rule sorting calculation flow chart of the present invention;

[0032] Figure 5 It is a flow chart of message parsing and diversion filtering processing of the present invention. DETAILED DESCRIPTION

[0033] The present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0034] like Figure 1 As shown, the hardware form of the platform of the present invention is an ATCA chassis architecture, and the chassis is composed of a backplane, a main control board, a line board, and a switch board. The main control board, the line board, and the switch board are connected to the backplane connector to realize Ethernet communication between the boards. The main control board is responsible for the command control of all boards in the ATCA chassis, and assumes part of the function of rule management. The main control board can be connected to the external network management software through the RJ45 Ethernet interface, and is responsible for receiving the monitoring management commands of the network management software and communicating with the network management software.

[0035] The line card has multiple 1G / 10G input and output optical ports, which are responsible for receiving traffic and forwarding L2 layer traffic output after filtering; the switch card has multiple 10G / 40G input and output optical ports, which are responsible for receiving L2 layer traffic aggregated from the line card and L3 traffic from the input port of the switch card, and forwarding output traffic after filtering. In addition, FPGA modules and TCAM chips are deployed in the switch card to be responsible for message parsing and diversion filtering; the backplane routing interconnects the cards in all slots in the chassis to achieve network port interoperability.

[0036] The network communication protocol between the main control board, line board and switch board is mainly based on the private communication protocol of TCP and UDP.

[0037] The line card has 28 1G SFP+ and 4 10G SFP+ optical module interfaces, which are responsible for receiving and sending L2 Ethernet optical signal flows. In addition, the line card also has a 40G QSFP optical module interface, which is connected to one of the 40G QSFP optical module interfaces of the switch card through a pair of 40G QSFP optical modules and optical fibers. When the line card receives the Ethernet signal from the SFP+ optical module interface, it is responsible for forwarding the traffic to the switch card through 40G QSFP aggregation for traffic filtering. After completing the traffic filtering from the line card, the switch card sends the filtered traffic back to the line card from the 40G QSFP module interface. The line card specifies the destination forwarding port according to the filtering rules to complete the forwarding of the filtered message.

[0038] Since the 28 1G SFP+ optical module interfaces and 4 10GSFP+ optical module interfaces in the line card do not work at the same time in the actual application scenarios of this platform, the 40G bandwidth of the line card and the switch card can meet the needs of actual application scenarios.

[0039] The switch board has 12 10G SFP+ optical module interfaces and 2 40G QSFP28 optical module interfaces. One of the two 40G QSFP28 optical module interfaces is connected to the line board through a pair of 40G QSFP optical modules and optical fibers, and is responsible for receiving the Ethernet traffic that needs to be filtered from the line board and sending the filtered Ethernet traffic to the line board. The other optical module interfaces of the switch board are responsible for receiving the optical network data traffic from the Ethernet, and after the traffic filtering is completed, the filtered traffic is forwarded and sent out from the specified destination port according to the filtering rules. In addition, FPGA chips and TCAM chips are deployed in the switch board. These two modules are responsible for message parsing and diversion filtering processing.

[0040] like Figure 2 As shown in the figure, the main chip on the switch board is ZYNQ+FPGA+TCAM. In addition, the switch board is deployed with QSFP28 / SFP+ input and output modules, clock modules, power supply modules, memory and other modules.

[0041] This design uses the ZYNQ-7000 series processor, which is a processor of an extensible processing platform released by Xilinx. As the control system of the switching board, the ZYNQ processor interacts with the FPGA through the CHIP2CHIP communication method to implement functions such as filter rule configuration and hit statistics query, and controls the FPGA program upgrade through the SELECTMAP communication interface. ZYNQ can also complete the configuration and monitoring of the clock module and power module through the I2C interface. The ZYNQ processor is connected to the operating status indicator through the GPIO interface for the operating status indication of the switching board. ZYNQ is connected to the RJ45 Ethernet interface and the serial port debugging port for device debugging. The switching board ZYNQ processor supports two startup modes: EMMC startup or QSPI startup. In addition, ZYNQ is connected to the backplane through the backplane connector to communicate with the main control board through the Ethernet network.

[0042] The FPGA (field programmable gate array) processor used in this design is XCVU095-2FFVA2104I, which is replaceable. FPGA is the service processing module of the switch board, responsible for receiving filtering rules, receiving and sending optical signals such as SFP+ / QSFP28, extracting packet fields, and framing according to the Burst structure required by the Interlaken protocol, and transmitting the framing results to the NLA12000 TCAM chip, and deciding whether to discard each Ethernet packet of the data flow according to the matching search results of the NLA12000 TCAM chip for the packet, thereby completing the traffic filtering function.

[0043] The NLA12000 TCAM chip is a high-performance TCAM chip produced by Broadcom. The NLA12000 TCAM chip is responsible for receiving data traffic and control instructions from the FPGA, searching and matching the received Ethernet packet header information to determine whether there is packet header information that meets the conditions, and returning the matching search results.

[0044] The main function of the power supply module is to provide power solutions for the equipment.

[0045] The clock module provides multiple independent clocks for the FPGA module.

[0046] The QSFP28 / SFP+ input and output modules are mainly responsible for receiving and forwarding Ethernet optical input and output optical signals.

[0047] like Figure 3 As shown, the method for effectively solving the problem of multiple hits of packets on the traffic filtering and diversion platform has the following steps:

[0048] 1. The main control board receives and sends communication commands from the network management through the RJ45 Ethernet interface. After receiving the network management command, the main control board parses and processes the network management command, and manages data communication with the line board and switch card through the backplane according to the business process.

[0049] 2. The line card has 28 1G SFP+ optical module interfaces and 4 10G SFP+ optical module interfaces, which are responsible for receiving and sending L2 Ethernet optical signal traffic; the line card aggregates the received L2 layer message data through the QSFP28 optical module interface to the switch card for processing.

[0050] 3. The switch card receives the data traffic aggregated from the line card through a QSFP28 optical module interface, and sends the filtered data back to the line card through this QSFP28 optical module interface; the switch card is responsible for receiving the Ethernet optical signal flow and sending the optical signal traffic after L3 layer filtering through another QSFP28 optical module interface.

[0051] 4. After the ZYNQ processor on the switch board receives the user rule addition and deletion configuration commands from the main control board through the backplane, it parses the configuration commands, splits and reorganizes the user rules, and converts the user rules into the internal rule format. The ZYNQ processor on the switch board completes the rule sorting calculation and sends the re-sorted rules to the FPGA processor through the CHIP2CHIP interface.

[0052] 5. After receiving the network data traffic, the FPGA processor parses and performs diversion and filtering processing on the message through the management TCAM chip according to the rule configuration issued by the switch board ZYNQ processor.

[0053] 6. After completing the rule sorting calculation, the ZYNQ processor on the switch board stores the updated rules in the rule management library.

[0054] 7. When the ZYNQ processor on the switch board receives the query rule command from the main control board, it queries the rules in the rule management library and the relationship between these rules. The ZYNQ processor converts the internal rules of the device into user rules based on the relationship between the rules, and reports the query results to the main control board through the backplane network port. The main control board reports the query results to the user through the network management.

[0055] This platform is responsible for receiving configuration commands such as adding rules, deleting rules, and querying rules from the user. When receiving a command to add or delete rules from the user, the user command is parsed, the user rules are split and reorganized, and the user rules are converted into internal rule formats, and the rule sorting calculation is completed, and the re-sorted rules are sent to the FPGA processor. After the ZYNQ processor completes the rule sorting calculation, the updated rules are also stored in the rule management library. When receiving a command to query rules, the ZYNQ processor queries the rules of the rule management library and the association between these rules, and converts the rules inside the device into user rules based on the association between the rules and reports them to the user. When the input unit receives traffic data from the network from different SFP+ and QSFP28 ports, these traffic data are parsed and filtered through packets, and then output from SFP+, QSFP28 and other ports according to the configuration of the rules.

[0056] In this embodiment, when a command to create or delete a rule is received, the user rule is first converted into an internal rule. The user rule is a rule format that conforms to international conventions or common usages, such as an IP address represented by a certain value and a mask. In order to simplify the rule management algorithm, all fields of these internal rules are represented in a unified format of maximum and minimum values, and the entire rule to be added or deleted is represented as a collection of all fields involved in this rule with a unified representation format.

[0057] After the user rule is converted to an internal rule, all rules associated with this rule in the rule management library will be searched according to the type of this rule. In this platform, the filtering rules involve many fields, but the filtering rules in actual applications may not use all fields. From the perspective of saving hardware resources and simplifying the rule management algorithm, the rule types are divided into two types: Layer 2 rules and Layer 3 rules. The Layer 2 rules contain port numbers and fields related to the OSI model data link layer. The fields of the Layer 3 rules are the IP five-tuple related fields and L2ID. L2ID is the ID tag assigned to the Layer 2 rules involved in this Layer 3 rule. In addition, regarding the calculation of management rules, since the rules are expressed by the maximum and minimum values ​​of all fields, the association rule calculation can be simplified to a comparative calculation of the size relationship between the maximum and minimum values ​​of the same field.

[0058] After completing the association rule search, the association rules will be split and reorganized. When executing the deletion rule, all related rules are deleted from the rule management library, and those related rules that should not be deleted need to be reorganized into the original rule format and re-added and calculated. The subsequent addition process for these rules is the same as the normal rule addition process. When executing the addition of rules with intersection relationships, the intersection calculation is completed and the intersection is added to the rule management library as a new rule. In addition, the rule management library also saves all the association relationships of the rules, which can be divided into several categories: inclusion, inclusion, equality, intersection, and irrelevant. In addition, there is another situation of rule splitting. Since L2ID in the L3 rule is treated as a matching field, and the actual L2ID represents a second-layer rule, this rule may have some associated rules. The intersection of these associated rules and other fields of the newly added third-layer rule should also form a new third-layer rule.

[0059] After completing the splitting and reorganization calculations of the rules, these newly added rules are reinserted into the rule management library in the order in which the rules take effect first. The updated rules are also sent by the ZYNQ processor to the FPGA processor for traffic filtering processing.

[0060] like Figure 4 As shown, in step 4 of the present invention, the rule sorting calculation has the following operation steps:

[0061] Traverse the rule management library and compare the relationship between each rule in the current newly added rule and the original rule:

[0062] (a) When comparing the currently added rules to the original rules, update the filter output port, update the rule relationship table, and continue to compare the added rules with the rules behind the rule management library.

[0063] (b) When the newly added rule is compared to the original rule and is equal, the filter output port is updated, the rule relationship table is updated, and the rule is added.

[0064] (c) When comparing the current newly added rules to be included in the original rules, update the filter output port, update the rule relationship table, and insert the newly added rules before the original rules in the rule management library.

[0065] (d) When comparing the intersection of the current newly added rules and the original rules, find the intersection of the two rules and generate new rules. Compare the generated new rules with each of the original rules to determine whether there are identical rules. If there are related rules, directly update the filter output port number of the identical rules. If there are no identical rules, put the new rule intersection and the newly generated rule directly into the rule management library before the current original rule, and continue to compare and calculate the newly added rules with the subsequent original rules in the rule management library.

[0066] (e) When the currently added rule is found to be irrelevant to the original rule, the currently added rule is inserted at the end of the rule management library.

[0067] This embodiment describes in detail how to reinsert the newly added rules into the rule base in the order of related rules from small to large. The relationship between the newly added filtering rules and the rules in the rule base includes the following: containment, contained, equal, irrelevant, intersection, etc. The filtering rules in different relationships are as follows: Figure 4 Different branches insert rules and update the relationship between filtering rules and rules. Add related rules to the rule management library in ascending order. The principle is to add them according to the rule priority principle. The rules issued first by this platform take precedence. When a message hits the first issued rule, the corresponding action of this rule is executed. The filtering process of this message ends, and this message will no longer continue the hit matching action of the following rules.

[0068] like Figure 5 As shown, in step 5 of the present invention, the message parsing and flow filtering process has the following operation steps:

[0069] (1) The FPGA processor extracts the packet fields and sends them to the TCAM chip. The TCAM chip searches for the packet header information of each received message packet and performs Layer 2 rule filtering.

[0070] (2) The TCAM chip performs a header information matching search on the message data packets filtered by the Layer 2 rules, and the FPGA processor caches the TCAM search results. The FPGA decides whether to continue forwarding or discarding the message based on the TCAM search results.

[0071] (3) The FPGA then determines whether to perform Layer 3 rule filtering. If so, it adds an L2ID tag and sends it to the TCAM chip to perform Layer 3 rule filtering.

[0072] (4) The TCAM chip will perform a Layer 3 rule header information match search and return the search results to the FPGA processor cache. The FPGA will decide whether to continue forwarding or discard the message based on the TCAM search results.

[0073] (5) If the message needs to be forwarded further, the FPGA processor sends the data message to the destination output port according to the filtering rules, and the message parsing and diversion filtering process ends.

[0074] When the FPGA processor on the switch board receives network data traffic, it extracts the packet field, frames it according to the Burst structure required by the Interlaken protocol, and transmits the framing result to the TCAM module. When the TCAM module on the switch board receives data traffic and control instructions from the FPGA processor, it searches and matches the received Ethernet header information to determine whether there is any header information that meets the conditions, and returns the matching search results. The FPGA processor on the switch board determines whether to discard each Ethernet packet in the data traffic based on the TCAM matching search results for the Ethernet packet, and outputs the filtered traffic through the SFP+ / QSFP28 optical module interface according to the configuration rules.

[0075] According to the processing flow of this embodiment, the smaller rule is represented by a set of actions of all its parent rules. The smaller rule takes precedence to ensure that all actions of its parent rules are effective, thereby ensuring that when a single message matches multiple complex rules at the same time, the diversion and filtering actions of all rules can be executed, and the diversion and filtering of all rules are effective at the same time. In addition, the comparison of filtering rules in this solution is based on the comparison of rule management library table items. This implementation method greatly reduces the complexity of the code and improves the stability of the program.

[0076] The basic principle of message parsing and traffic filtering is to examine the packet header information of each received Ethernet packet, and decide whether to forward or discard the packet based on the matching and rules, so as to achieve the purpose of refusing to send suspicious packets. Figure 5 In the illustrated embodiment, the TCAM module is responsible for searching and matching the received Ethernet header information to determine whether there is any header information that meets the conditions, and returns the matching search results. For example, the source MAC address "00 80 16 00 00 00" of the Ethernet packet is written into the TCAM as a rule in advance. In the subsequent process of Ethernet header information flowing in, the TCAM will perform a source MAC matching search on the Ethernet header information. If the match is successful, a hit result will be returned. At this time, it can be known whether the Ethernet packet is forwarded or discarded. In this example, the processing is divided into two stages: the second layer rule and the third layer rule. Not only does it simplify the complexity of the rule management algorithm, it also saves the bit width of the matching field occupied by a single rule, saves TCAM resources, and increases the capacity of the maximum number of rules supported by this platform.

Claims

1. A method for effectively solving the problem of multiple hits of messages on a traffic filtering and diversion platform, characterized in that: The method has the following steps:

1. The main control board receives and sends communication commands from the network management through the RJ45 Ethernet interface. After receiving the network management command, the main control board parses and processes the network management command, and communicates management data with the line board and switch board through the backplane according to the business process; 2. The line card has 28 1G SFP+ optical module interfaces and 4 10G SFP+ optical module interfaces, which are responsible for receiving and sending L2 Ethernet optical signal traffic; the line card aggregates the received L2 layer message data to the switch card through the QSFP28 optical module interface for processing; 3. The switch card receives the data traffic aggregated from the line card through a QSFP28 optical module interface, and sends the filtered data back to the line card through this QSFP28 optical module interface; the switch card is responsible for receiving the L3 Ethernet optical signal flow and sending the L3 filtered optical signal traffic through another QSFP28 optical module interface; 4. After the ZYNQ processor on the switch board receives the user rule addition and deletion configuration commands from the main control board through the backplane, it parses the configuration commands, splits and reorganizes the user rules, and converts the user rules into the internal rule format. The ZYNQ processor on the switch board completes the rule sorting calculation and sends the re-sorted rules to the FPGA processor through the CHIP2CHIP interface.

5. After receiving the network data traffic, the FPGA processor parses and performs flow filtering on the message through the management TCAM chip according to the rule configuration issued by the switch card ZYNQ processor; 6. After completing the rule sorting calculation, the ZYNQ processor on the switch card stores the updated rules in the rule management library; 7. When the ZYNQ processor on the switch board receives the query rule command from the main control board, it queries the rules in the rule management library and the relationship between these rules. The ZYNQ processor converts the internal rules of the device into user rules based on the relationship between the rules, and reports the query results to the main control board through the backplane network port. The main control board reports the query results to the user through the network management; The effective solution to the message multi-hit traffic filtering and diversion platform includes a main control board, a line board and a switch board installed in a chassis and connected to a backplane. The switch board is provided with a ZYNQ processor, an FPGA processor, a TCAM chip, a clock module and a power supply module. The ZYNQ processor is connected to a DDR3 memory, and is connected to an EMMC memory and a QSPI memory through an SPI interface respectively. The ZYNQ processor is connected to a connector on the backplane through an RGMII network port. The ZYNQ processor is connected to the FPGA processor through a SELECTMAP interface and a CHIP2CHIP interface respectively. The ZYNQ processor is connected to a clock module and a power supply module through an I2C interface respectively. The ZYNQ processor is connected to a running status indicator through a GPIO interface. The ZYNQ processor is connected to an RJ45 Ethernet debugging interface through an RGMII interface. The ZYNQ processor is connected to a serial debugging port through a UART interface. The FPGA processor is connected to two 40G QSFP28 optical module interfaces and 12 10G SFP+ optical module interfaces through TX / RX interfaces respectively, and the FPGA processor is connected to a TCAM chip through an Interlake interface.

2. According to claim 1, a method for effectively solving the problem of multiple hits of packets in the traffic filtering and diversion platform is characterized in that: In step 4, the rule sorting calculation has the following steps: Traverse the rule management library and compare the relationship between each rule in the current newly added rule and the original rule: (a) When comparing the newly added rules to the original rules, update the filter output port, update the rule relationship table, and continue to compare the newly added rules with the rules behind the rule management library; (b) When the newly added rule is equal to the original rule, the filter output port is updated, the rule relationship table is updated, and the rule is added. (c) When comparing the current newly added rule to be included in the original rule, update the filter output port, update the rule relationship table, and insert the newly added rule before the original rule in the rule management library; (d) When comparing the intersection of the current newly added rule and the original rule, find the intersection of the two rules, generate a new rule, compare the generated new rule with each of the original rules, and determine whether there are identical rules. If there are identical rules, directly update the filter output port number of the identical rule. If there are no identical rules, put the new rule intersection and the newly generated rule directly into the rule management library before the current original rule, and continue to compare and calculate the newly added rule with the subsequent original rules in the rule management library; (e) When the currently added rule is found to be irrelevant to the original rule, the currently added rule is inserted at the end of the rule management library.

3. According to claim 1, a method for effectively solving the problem of multiple hits of packets in the traffic filtering and diversion platform is characterized in that: In step 5, the message parsing and flow filtering process has the following steps: (1) The FPGA processor extracts the packet fields and sends them to the TCAM chip. The TCAM chip searches for the packet header information of the received packets one by one and performs Layer 2 rule filtering. (2) The TCAM chip performs a header information matching search on the message data packets filtered by the Layer 2 rules, and the FPGA processor caches the TCAM search results. The FPGA decides whether to continue forwarding or discarding the message based on the TCAM search results. (3) The FPGA then determines whether to perform Layer 3 rule filtering. If so, it adds an L2ID tag and sends it to the TCAM chip for Layer 3 rule filtering. (4) The TCAM chip will perform a Layer 3 rule header information match search and return the search results to the FPGA processor cache. The FPGA will decide whether to continue forwarding or discard the message based on the TCAM search results. (5) If the message needs to be forwarded further, the FPGA processor sends the data message to the destination output port according to the filtering rules, and the message parsing and diversion filtering process ends.

Images