Protocol message uploading method and device

Abstract

The invention discloses a method and a device for uploading a protocol message, and relates to the technical field of switch chip forwarding, the method for uploading the protocol message comprises the following steps: when a protocol message table item is scoured or deleted, issuing a first ACL (Access Control List) table for limiting the speed of a corresponding missing mechanism message; related protocol message table items are learned based on the missing mechanism message and then issued, and the first ACL table is deleted; in a protocol message identification uploading stage, a destination address matching item is added in a issued second ACL table, and an uploading mode is adjusted to be redirected to the cpu; and if the destination address of the protocol message is the address of the device, executing redirection to the cpu command for uploading. According to the method and the device, the CPU load can be reduced when the protocol message is uploaded, and whether the protocol message needs to be uploaded to the CPU or not can be accurately identified.

Description

Technical Field

[0001] The present application relates to the technical field of switch chip forwarding, and in particular to a method and device for sending a protocol message. Background Art

[0002] The implementation of the protocol requires that the message be sent to the CPU for processing. For the protocols sent to the CPU, accurate identification is required to avoid sending protocols that do not need to be sent to the CPU. In addition, for the learning of some table items, the upper layer only needs to receive the corresponding message to complete the learning of the table item without sending a large number of messages.

[0003] Specifically, when two PCs perform Layer 3 forwarding through a switch, during the ARP (Address Resolution Protocol) or NDP (Neighbor Discovery Protocol) learning period, the switch will learn the ARP / ND entries of the two PCs. The subsequent communication between the two PCs is carried out directly by checking the Layer 3 entries (ARP / ND entries) on the switch, and the messages do not need to be processed by the CPU. This can reduce the CPU load and improve forwarding efficiency (hardware forwarding).

[0004] In this context, when the device has learned the corresponding ARP / ND table entries, a large amount of data traffic is forwarded by looking up the ARP / ND table entries on the device. If the ARP / ND table entries on the switch are flushed, a large amount of data traffic cannot find the ARP / ND table entries for Layer 3 forwarding. At this time, a large amount of traffic is ARPMISS / NDMISS messages. In order to continue learning ARP / ND table entries for Layer 3 table lookup and forwarding, a large amount of ARPMISS / NDMISS traffic needs to be sent to the CPU, and the upper layer learns ARP / ND based on ARPMISS / NDMISS.

[0005] When a large number of ARPMISS / NDMISS packets are sent to the CPU, a large number of ARPMISS / NDMISS packets will occupy the CPU queue buffer. In the actual process, it is very likely that the ARPMISS / NDMISS packets of the same IP / IPv6 will occupy all the CPU queue buffers, resulting in the CPU processing the same ARPMISS / NDMISS packet for a period of time (the CPU can learn the corresponding ARP / ND table entry after receiving an ARPMISS / NDMISS packet), and being unable to process ARPMISS / NDMISS packets of other IP / IPv6, thereby affecting the learning of other ARP / ND table entries.

[0006] In addition, in the traditional solution, when configuring the device's Layer 3 interface and the corresponding ipv4 address, the upper layer will send ARP (including ARP, RARP, and free ARP) messages. Its rule is ethertype0x806, and the action is copy to cpu. Although this solution can send ARP related messages, there are two problems in this solution:

[0007] (1) Since the device does not distinguish whether the relevant ARP message is sent to the CPU, when the relevant ARP message only wants to be transparently transmitted through the device, the device recognizes that it is an ARP message and sends a copy of the ARP message that only needs to be transparently transmitted to the CPU, increasing the CPU load.

[0008] (2) When traffic in the same VLAN is forwarded at line speed (full bandwidth) between two ports, and other devices request the ARP of this device through the ports in the same VLAN or attack the ARP flow of this device, the ARP message will also be flooded in the corresponding VLAN, thereby affecting the forwarding of data traffic in the same VLAN.

[0009] Similarly, when configuring the device's Layer 3 interface and the corresponding IPv6 address, the device will also send and receive related NDP messages, which will also have problems similar to ARP messages. Summary of the invention

[0010] The present application provides a method and device for sending a protocol message, which can reduce the CPU load when sending the protocol message and can accurately identify whether the protocol message needs to be sent to the CPU.

[0011] In a first aspect, an embodiment of the present application provides a method for sending a protocol message, and the method for sending a protocol message includes:

[0012] When the protocol message table entry is flushed or deleted, the first ACL table is issued to limit the speed of the corresponding missing mechanism message;

[0013] Based on the missing mechanism message, the relevant protocol message table items are learned and then issued, and the first ACL table is deleted;

[0014] During the protocol message identification and sending stage, a destination address matching item is added to the second ACL table sent down, and the sending mode is adjusted to redirect to the CPU;

[0015] If the destination address of the protocol message is the address of the local device, the redirect-to-cpu command is executed to send it up.

[0016] In combination with the first aspect, in one implementation, in the protocol message identification and sending stage, adding a destination address matching item in the sent second ACL table includes:

[0017] For ARP protocol packets with different source and destination IP addresses, add the Layer 3 interface IP4 address to the second ACL table.

[0018] In combination with the first aspect, in one implementation, the method further includes:

[0019] For ARP protocol packets with the same source and destination IP addresses, a new third ACL table is sent down for matching, and the sending mode is adjusted to copy to CPU.

[0020] In combination with the first aspect, in one implementation, in the protocol message identification and sending stage, adding a destination address matching item in the sent second ACL table includes:

[0021] For the NS message in the NDP protocol message, the layer 3 interface ip6 address is added to the second ACL table.

[0022] In combination with the first aspect, in one implementation, in the protocol message identification and sending stage, adding a destination address matching item in the sent second ACL table includes:

[0023] For the NA message in the NDP protocol message that replies to the NUD request, the layer 3 interface ip6 address is added to the second ACL table.

[0024] In combination with the first aspect, in one implementation, the method further includes:

[0025] For the NA message in the NDP protocol message that replies to the DAD request, and the automatic sending class announcement message analysis, the fourth ACL table is newly issued for matching, and the sending mode is adjusted to copy to the CPU.

[0026] In combination with the first aspect, in one implementation, the method further includes:

[0027] Determine whether the destination address of the protocol message and the address of the local device are mapped or corresponded one by one to determine whether the NDP protocol message is identifiable.

[0028] In combination with the first aspect, in one implementation, the method further includes:

[0029] A timer is set, and if no missing mechanism message is sent within a certain period of time, the first ACL table is deleted.

[0030] In a second aspect, an embodiment of the present application provides a device for sending a protocol message, wherein the device for sending a protocol message includes:

[0031] A message learning module, which is used to issue a first ACL table for limiting the speed of corresponding missing mechanism messages when the protocol message table entry is flushed or deleted, and the message learning module also issues and deletes the first ACL table after learning the relevant protocol message table entry based on the missing mechanism message;

[0032] The message identification module is used to add a destination address matching item in the second ACL table sent down during the protocol message identification and sending stage to determine whether the destination address of the protocol message is the address of this device, and adjust the sending mode to redirect to the CPU.

[0033] In conjunction with the second aspect, in one implementation, the message learning module is further used to:

[0034] A timer is set, and if no missing mechanism message is sent within a certain period of time, the first ACL table is deleted.

[0035] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0036] The method for sending protocol messages in the present application, when the protocol message table entry is flushed or deleted, sends down the first ACL table for limiting the speed of the corresponding missing mechanism message; sends down the relevant protocol message table entry based on the missing mechanism message, and deletes the first ACL table; in the protocol message identification and sending stage, adds the destination address matching item in the sent second ACL table, and adjusts the sending mode to redirect to CPU; if the destination address of the protocol message is the address of the local device, executes the redirect to CPU command for sending.

[0037] Therefore, on the one hand, when the protocol message table entry (ARP / ND table entry) changes, the corresponding ARP / ND table entry is notified to the upper layer, and the corresponding speed limit ACL under the corresponding ARP / ND table entry is used to prevent ARPMISS / NDMISS messages from occupying a large number of CPU queue buffers. When the corresponding ARP table entry is re-learned through the ARPMISS / NDMISS sent up, the ACL for speed limit on the ARP message is deleted.

[0038] On the other hand, based on the traditional technology, the corresponding destination address matching items are added, and the original copy to cpu action is modified to redirect to cpu, so as to identify whether the message is the message needed by this device. If it is the message needed by this device, it will hit the corresponding ACL entry and execute the corresponding redirect to cpu action. Therefore, the message needed by this device will not be flooded in the corresponding vlan, thereby affecting the line-speed forwarding of data traffic of other ports in the same vlan; at the same time, when the message needs to be flooded through this device, due to the addition of the destination address matching item, the message will not hit the corresponding ACL entry table item, and will only be transparently transmitted in this device, so the message will not be sent to the CPU, thereby reducing the CPU load. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A flowchart of an embodiment of a method for sending a protocol message of the present application;

[0040] Figure 2 Flowchart for solving the slow learning of ARP / ND entries through ARPMISS / NDMISS for this application;

[0041] Figure 3 A flowchart to solve whether ARP / ND should be sent to the CPU for this application;

[0042] Figure 4 This is a structural block diagram of an embodiment of a device for sending protocol messages of the present application. DETAILED DESCRIPTION

[0043] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0044] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0045] In a first aspect, an embodiment of the present application provides a method for sending a protocol message.

[0046] In one embodiment, referring to Figure 1 As shown, Figure 1 This is a flow chart of an embodiment of the method for sending a protocol message of this application. Figure 1As shown in the figure, the methods for sending protocol packets include:

[0047] S1. When the protocol message table entry is flushed or deleted, the first ACL table is issued to limit the speed of the corresponding missing mechanism message;

[0048] S2, learning related protocol message table entries based on missing mechanism messages and then issuing them, deleting the first ACL table;

[0049] S3. In the protocol message identification and sending stage, a destination address matching item is added to the second ACL table sent down, and the sending mode is adjusted to redirect to the CPU;

[0050] S4. If the destination address of the protocol message is the address of the local device, execute the redirect to cpu command to send it upward.

[0051] The protocol message table items in this embodiment include ARP / ND table items, and the missing mechanism messages include ARPMISS / NDMISS messages. This application is divided into two aspects, which mainly solve the problem of slow ARP learning through ARPMISS / NDMISS, and how to accurately identify whether the protocol message needs to be sent to the CPU to reduce the CPU load.

[0052] Regarding the problem of slow ARP learning by ARPMISS / NDMISS, it is worth noting that, taking ARP Miss as an example, if a user in the network sends a large number of IP packets whose target IP addresses cannot be resolved to the device (that is, there is a routing table entry corresponding to the destination IP of the IP packet in the routing table, but there is no ARP table entry corresponding to the next hop in the routing table entry on the device), the device will trigger a large number of ARP Miss messages. Such IP packets that trigger ARP Miss messages will be sent to the device for processing. The device will generate and issue a large number of temporary ARP table entries based on the ARP Miss messages and send a large number of ARP request packets to the destination network, which will increase the burden on the device CPU and seriously consume the bandwidth resources of the destination network.

[0053] Generally speaking, in order to prevent CPU congestion and device paralysis, the CPU will be protected from attacks, that is, the rate of messages sent to the CPU will be limited. When the device cannot distinguish whether a message is sent to the CPU, the rate limit can only be based on the CPU queue (taking ICMP messages as an example: in order to prevent the CPU from being paralyzed by too many ICMP messages sent to the CPU, and the chip cannot identify whether the ICMP is an ICMP message sent to the CPU, if the rate limit is based on the flow, at this time, because the device has to look up the three-layer table entries or only the ICMP messages that are transparently transmitted in the device, this will affect the forwarding of the three-layer table entries or only the ICMP messages that are transparently transmitted in the device).

[0054] The device uses the CPU queue-based rate limit. Although the CPU queue-based rate limit can realize the CPU anti-attack function, when a large number of ARPMISS packets are sent to the CPU, a large number of ARPMISS / NDMISS packets will occupy the CPU queue buffer. The common situation is: if ARPMISS / NDMISS is allocated to CPU queue 1, and the buffer size of CPU queue 1 is 2000pps, and the CPU rate limit is 60pps, then there is a high probability that the ARPMISS / NDMISS packet of the same IP / IPv6 will occupy the buffer of CPU queue 1. fer is fully occupied, resulting in a period of time, for example, the CPU has been processing the same ARPMISS / NDMISS message in the upper layer during 2000 / 60 seconds (in fact, for the same ip / ipv6 address, the CPU can learn the corresponding ARP / ND table entry after receiving one ARPMISS / NDMISS message, and the ARPMISS / NDMISS for the same ip / ipv6 does not require so many), increasing the CPU load, and the CPU cannot process the ARPMISS / NDMISS messages of other ip / ipv6, which in turn affects the learning of other ARP / ND table entries.

[0055] To solve the above problem, this embodiment notifies the upper layer when the ARP / ND table entry is flushed or deleted. At this time, the upper layer sends the first ACL table of the speed limit ACL for the ARPMISS / NDMISS without the ARP / ND table entry. When the subsequent ARPMISS / NDMISS message is sent to the CPU through the route, after learning the corresponding ARP / ND table entry, the ARP / ND table entry is sent down, and then the first ACL table of the corresponding ARP / ND table entry is deleted to enable normal forwarding.

[0056] In addition, if no ARPMISS / NDMISS message is sent subsequently, the first ACL table sent down cannot be deleted. The solution at this time is that the upper layer sets a timer. If no ARPMISS / NDMISS message is sent up within a certain period of time, the first ACL table sent down is also deleted.

[0057] For more information, see Figure 2 As shown:

[0058] 1. When the ARP / ND table entry is flushed or deleted, the upper layer is notified of the relevant ARP / ND table entry;

[0059] 2. After the upper layer receives the ARP / ND entry to be deleted, it uses ACL to match the corresponding ARP / ND message and limits the speed for the ARP / ND entry to be deleted, to prevent too many messages from being sent to the CPU and causing the ARPMISS / NDMISS messages of the same IP / IPv6 to occupy the queue buffer, so that the CPU can only receive the ARPMISS / NDMISS messages of the same IP / IPv6 within a period of time, affecting the learning speed of other ARP / ND entries;

[0060] 3. When the subsequent ARPMISS / NDMISS message is sent to the CPU through the router, after learning the corresponding ARP / ND, the ARP / ND table entry is sent down, and then the rate limit acl table entry for the ARPMISS / NDMISS message is deleted, so that it can normally search the three-layer table entry for forwarding.

[0061] 4. If no ARPMISS / NDMISS message is sent subsequently, the speed limit ACL sent down cannot be deleted. The solution at this time is that the upper layer sets a timer. If no ARPMISS / NDMISS message is sent up within a certain period of time, the ACL table entry for the speed limit of ARPMISS / NDMISS messages sent down will also be deleted.

[0062] To solve the problem that the device cannot distinguish whether ARP / ND packets are sent to the CPU: In the packet identification and sending stage, it is necessary to add destination address matching items and change the corresponding copy to cpu to redirect to cpu based on the traditional solution, so as to accurately determine whether ARP / ND packets are sent to the CPU, thereby reducing the CPU load.

[0063] See also Figure 3 As shown in the figure, the following introduces ARP packets and NDP packets respectively:

[0064] 1. For ARP (ARP / RARP) messages:

[0065] 1.1. On the basis of the traditional solution, when sending the ACL related to ARP, a destination address matching item dip (layer 3 interface ip) is added to the rule, and the action is changed from copy to cpu to redirect to cpu. At this time, the rule of the second ACL table sent is ethertype0x806+dip (layer 3 interface ip), and the corresponding action is redirct to cpu. This solution solves the problem that the device cannot identify whether the ARP (ARP / RARP) is the message required by the device, and sends the unnecessary ARP message to the CPU, increasing the CPU load;

[0066] It is worth noting that copy to cpu refers to copying data from memory or other storage devices to the cache or registers of the central processing unit (CPU). redirct to cpu usually refers to changing the flow of data or instructions so that they are sent directly to the CPU for processing instead of being stored elsewhere first.

[0067] 1.2. The above solution can accurately identify whether the relevant ARP is sent to the CPU, but at this time, the free ARP (arp message with the same source and destination IP) cannot be sent up, so on this basis, a new ACL (the third ACL table) is needed to send the free ARP up. At this time, the rule of the ACL sent down is to match the free ARP, and the action is still copy to cpu (free ARP is mainly to notify the local device of the peer device. When the notification needs to be transparently transmitted, it also needs to be forwarded at this time, so the action is still copy to cpu).

[0068] 2. Regarding NDP messages:

[0069] Before implementing the solution, it is necessary to understand whether the destination address of the message is the address of this device by comparing it. If it is, it will be sent up. Therefore, only when the destination address of the message can be mapped one-to-one with the address of the device through a certain mapping method can it be identified. Therefore, for the messages in the NDP protocol message, only when the destination address of the NA and NS messages is mapped one-to-one with the ipv6 address of this device, or can be queued one-to-one according to a certain correspondence, can it be identified. The specific solution is as follows:

[0070] 2.1. For NS (Neighbor Solicitation) messages (including address conflict detection (DAD), neighbor reachability detection (NUD), and address resolution request messages), a dipv6 (ff02::1:ffxx:xxxx (where the last 24 bits of the address xx:xxxx are the last 24 bits of the IPv6 address of the Layer 3 interface)) address can be added to the NS message identification. The corresponding action is changed from copy to cpu to redirect to cpu. This step solves the problem of the device being unable to accurately identify whether the NS message is the NS message required by the device, thereby reducing the CPU load.

[0071] 2.2. For NA (Neighbor Advertisement) messages (analysis of announcement messages requested by neighbor nodes (NA messages in reply to NUD requests)), for NA reply address resolution messages in reply to NUD, similar processing is adopted as NS, except that the destination IPv6 address of the NS message here is a unicast address, so a dipv6 (layer 3 interface IPv6 address) needs to be added at this time, and the action is changed from copy to cpu to redirect to cpu. This step solves the problem that the device cannot accurately identify whether the NS message is the NA message (NA message in reply to DAD request) required by the device, thereby reducing the CPU load;

[0072] 2.3. For NA messages (analysis of announcement messages requested by neighbor nodes (NA messages in reply to DAD requests), analysis of automatically sent announcement messages (similar to free ARP)), a new ACL (the fourth ACL table) is also required for upload. At this time, since the destination IPv6 of this message is FF02::1, an idipv6 (FF02::1) is added for this NA message, and the action remains unchanged, which is still copy to cpu (since such messages need to be transparently transmitted through the device, the action needs to be copy to cpu).

[0073] To summarize, the method for sending protocol messages in the present application, when the protocol message table entry is flushed or deleted, sends down the first ACL table for limiting the speed of the corresponding missing mechanism message; learns the relevant protocol message table entry based on the missing mechanism message and then sends it down, and deletes the first ACL table; in the protocol message identification and sending stage, adds the destination address matching item in the sent second ACL table, and adjusts the sending mode to redirect to the CPU; if the destination address of the protocol message is the address of this device, executes the redirect to CPU command for sending.

[0074] Therefore, on the one hand, when the protocol message table entry (ARP / ND table entry) changes, the corresponding ARP / ND table entry is notified to the upper layer, and the corresponding speed limit ACL under the corresponding ARP / ND table entry is used to prevent ARPMISS / NDMISS messages from occupying a large number of CPU queue buffers. When the corresponding ARP table entry is re-learned through the ARPMISS / NDMISS sent up, the ACL for speed limit on the ARP message is deleted.

[0075] On the other hand, based on the traditional technology, the corresponding destination address matching items are added, and the original copy to cpu action is modified to redirect to cpu, so as to identify whether the message is the message needed by this device. If it is the message needed by this device, it will hit the corresponding ACL entry and execute the corresponding redirect to cpu action. Therefore, the message needed by this device will not be flooded in the corresponding vlan, thereby affecting the line-speed forwarding of data traffic of other ports in the same vlan; at the same time, when the message needs to be flooded through this device, due to the addition of the destination address matching item, the message will not hit the corresponding ACL entry table item, and will only be transparently transmitted in this device, so the message will not be sent to the CPU, thereby reducing the CPU load.

[0076] In a second aspect, an embodiment of the present application also provides a device for sending a protocol message.

[0077] In one embodiment, referring to Figure 4 , Figure 4 This is a structural block diagram of an embodiment of a device for sending a protocol message of this application. Figure 4 As shown, the device for sending the protocol message includes:

[0078] A message learning module, which is used to issue a first ACL table for limiting the speed of corresponding missing mechanism messages when the protocol message table entry is flushed or deleted, and the message learning module also issues and deletes the first ACL table after learning the relevant protocol message table entry based on the missing mechanism message;

[0079] The message identification module is used to add a destination address matching item in the second ACL table sent down during the protocol message identification and sending stage to determine whether the destination address of the protocol message is the address of this device, and adjust the sending mode to redirect to the CPU.

[0080] Furthermore, in one embodiment, the message identification module adds a destination address matching item in the second ACL table sent down during the protocol message identification and sending stage, including:

[0081] For ARP protocol packets with different source and destination IP addresses, add the Layer 3 interface IP4 address to the second ACL table.

[0082] Furthermore, in one embodiment, the message identification module is also used for:

[0083] For ARP protocol packets with the same source and destination IP addresses, a new third ACL table is sent down for matching, and the sending mode is adjusted to copy to CPU.

[0084] Furthermore, in one embodiment, the message identification module adds a destination address matching item in the second ACL table sent down during the protocol message identification and sending stage, and further includes:

[0085] For the NS message in the NDP protocol message, the layer 3 interface ip6 address is added to the second ACL table.

[0086] Furthermore, in one embodiment, the message identification module adds a destination address matching item in the second ACL table sent down during the protocol message identification and sending stage, and further includes:

[0087] For the NA message in the NDP protocol message that replies to the NUD request, the layer 3 interface ip6 address is added to the second ACL table.

[0088] Furthermore, in one embodiment, the message identification module is also used for:

[0089] For the NA message in the NDP protocol message that replies to the DAD request, and the automatic sending class announcement message analysis, the fourth ACL table is newly issued for matching, and the sending mode is adjusted to copy to the CPU.

[0090] Furthermore, in one embodiment, the message identification module is also used for:

[0091] Determine whether the destination address of the protocol message and the address of the local device are mapped or corresponded one by one to determine whether the NDP protocol message is identifiable.

[0092] Furthermore, in one embodiment, the message learning module is further used for:

[0093] A timer is set, and if no missing mechanism message is sent within a certain period of time, the first ACL table is deleted.

[0094] Among them, the functional implementation of each module in the above-mentioned device for sending protocol messages corresponds to each step in the above-mentioned method embodiment for sending protocol messages, and its functions and implementation processes are no longer repeated here.

[0095] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0096] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0097] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0098] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0099] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0100] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for sending a protocol message, characterized in that: The method for sending the protocol message includes: When the protocol message table entry is flushed or deleted, the first ACL table is issued to limit the speed of the corresponding missing mechanism message; Based on the missing mechanism message, the relevant protocol message table items are learned and then issued, and the first ACL table is deleted; During the protocol message identification and sending stage, a destination address matching item is added to the second ACL table sent down, and the sending mode is adjusted to redirect to the CPU; If the destination address of the protocol message is the address of the local device, the redirect-to-cpu command is executed to send it up.

2. The method for sending a protocol message as claimed in claim 1, characterized in that: In the protocol message identification and sending stage, adding a destination address matching item in the sent second ACL table includes: For ARP protocol packets with different source and destination IP addresses, add the Layer 3 interface IP4 address to the second ACL table.

3. The method for sending a protocol message as claimed in claim 2, characterized in that: Also includes: For ARP protocol packets with the same source and destination IP addresses, a new third ACL table is sent down for matching, and the sending mode is adjusted to copy to CPU.

4. The method for sending a protocol message as claimed in claim 1, characterized in that: In the protocol message identification and sending stage, adding a destination address matching item in the sent second ACL table includes: For the NS message in the NDP protocol message, the layer 3 interface ip6 address is added to the second ACL table.

5. The method for sending a protocol message as claimed in claim 1, characterized in that: In the protocol message identification and sending stage, adding a destination address matching item in the sent second ACL table includes: For the NA message in the NDP protocol message that replies to the NUD request, the layer 3 interface ip6 address is added to the second ACL table.

6. The method for sending a protocol message as claimed in claim 1, characterized in that: Also includes: For the NA message in the NDP protocol message that replies to the DAD request, and the automatic sending class announcement message analysis, the fourth ACL table is newly issued for matching, and the sending mode is adjusted to copy to the CPU.

7. The method for sending a protocol message according to any one of claims 4 to 6, characterized in that: Also includes: Determine whether the destination address of the protocol message and the address of the local device are mapped or corresponded one by one to determine whether the NDP protocol message is identifiable.

8. The method for sending a protocol message as claimed in claim 1, characterized in that: Also includes: A timer is set, and if no missing mechanism message is sent within a certain period of time, the first ACL table is deleted.

9. A device for sending a protocol message, characterized in that: The device for sending the protocol message includes: A message learning module, which is used to issue a first ACL table for limiting the speed of corresponding missing mechanism messages when the protocol message table entry is flushed or deleted, and the message learning module also issues and deletes the first ACL table after learning the relevant protocol message table entry based on the missing mechanism message; The message identification module is used to add a destination address matching item in the second ACL table sent down during the protocol message identification and sending stage to determine whether the destination address of the protocol message is the address of this device, and adjust the sending mode to redirect to the CPU.

10. The device for sending a protocol message as claimed in claim 9, characterized in that: The message learning module is also used for: A timer is set, and if no missing mechanism message is sent within a certain period of time, the first ACL table is deleted.

Images