A method and apparatus for detecting

Abstract

The embodiment of the application provides a detection method and device, relates to the network technical field, is applied to network equipment, and the network equipment has a first table item group, a second table item group and a third table item group corresponding to each first destination address; the method comprises the following steps: determining a target unicast table item which changes; obtaining at least one second destination address from a plurality of first destination addresses according to a target address; for each second destination address, based on the first table item group and the second table item group corresponding to the second destination address, detecting whether a flow specification table item in the third table item group corresponding to the second destination address is invalid. The scheme provided by the embodiment of the application can save the calculation resources consumed by the validity detection of the flow specification table item when the unicast routing table item changes.

Description

Technical Field

[0001] This application relates to the field of network technology, and in particular to a detection method and apparatus. Background Technology

[0002] Flow Specification's traffic control policies can precisely match specific traffic (source address, destination address, source port, destination port, protocol type, etc.), and offer multiple options for specific traffic actions: dropping, rate limiting, traffic redirection, etc.

[0003] Leveraging the multi-protocol extension capabilities of BGP (Border Gateway Protocol), the flow specification's traffic control policy can be distributed by one network device to other network devices configured with BGP, and issued as flow specification entries in the forwarding plane for traffic forwarding according to the flow control policy.

[0004] When flow specification entries perform traffic matching control for a specific destination address, the destination address in the flow specification entry needs to be validated. Flow specification entries that fail the validation will not take effect. The validation process involves comparing the destination address of the flow specification entry with the destination address in the unicast routing table entry. Therefore, any change in the unicast routing table entry may cause a change in the validity validation result of the flow specification entry, thus requiring a re-validation of each flow specification entry. In real-world network environments, unicast routing table entries in network devices change frequently, leading to frequent validity checks of flow specification entries and wasting significant computational resources. Summary of the Invention

[0005] The purpose of this application is to provide a detection method and apparatus to save computational resources consumed in detecting the validity of flow specification entries when unicast routing table entries change. The specific technical solution is as follows:

[0006] In a first aspect, embodiments of this application provide a detection method applied to a network device, wherein the network device stores a first entry group, a second entry group, and a third entry group corresponding to each first destination address;

[0007] The first entry group includes: a first unicast routing entry, wherein the first destination address is located in the network segment corresponding to the destination address in the first unicast routing entry;

[0008] The second entry group includes: a second unicast routing entry, wherein the destination address in the second unicast routing entry is located in the network segment corresponding to the first destination address, and the destination address of the second unicast routing entry is different from the first destination address;

[0009] The third entry group includes: a flow specification entry whose destination address is the first destination address;

[0010] The method includes:

[0011] Identify the target unicast entry that has changed, wherein the destination address in the target unicast entry is the target address, and the target unicast entry is a newly added unicast routing entry, or a unicast routing entry removed from the routing table, or a unicast routing entry whose contained information has been updated.

[0012] Based on the target address, at least one second destination address is obtained from a plurality of first destination addresses, wherein the second destination address is located in the network segment corresponding to the target address, or, if the target address is different from the second destination address, the target address is located in the network segment corresponding to the second destination address;

[0013] For each second destination address, based on the first and second entry groups corresponding to the second destination address, check whether the flow specification entry in the third entry group corresponding to the second destination address is invalid.

[0014] In one embodiment of this application, if the second destination address is located in the network segment corresponding to the target address, the step of detecting whether the flow specification entry in the third entry group corresponding to the second destination address is invalid based on the first entry group and the second entry group corresponding to the second destination address includes:

[0015] Update the first entry group corresponding to the second destination address based on the target unicast entry;

[0016] When the first optimal entry in the first entry group is updated, the first flow specification entry corresponding to the first optimal entry is determined to be invalid. The first flow specification entry contains the second destination address and is different from the source node of the first optimal entry. The source node is another network device that initiates entry synchronization to the network device. The first optimal entry is: an entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0017] If any one of the first autonomous domains is different from the second autonomous domain, then the second flow specification entry is determined to be invalid. The second flow specification entry is: other flow specification entries in the third entry group corresponding to the second destination address, excluding the first flow specification entry. The first autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous domain is the autonomous domain where the network device is located. The second autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of the first optimal entry corresponding to the second destination address.

[0018] In one embodiment of this application, in the first entry group corresponding to each first destination address, based on the longest mask matching principle, unicast routing entries are arranged in descending order of matching degree with the first destination address, and the first optimal entry in the first entry group is determined to have been updated in the following way:

[0019] If the unicast routing entry that is first in the order of the first entry group is updated, then the first optimal entry in the first entry group is determined to have been updated.

[0020] In one embodiment of this application, if the target address is different from the second destination address, and the target address is located in the network segment corresponding to the second destination address, the step of detecting whether the flow specification entry in the third entry group corresponding to the second destination address is invalid based on the first entry group and the second entry group corresponding to the second destination address includes:

[0021] Update the second entry group corresponding to the second destination address based on the target unicast entry;

[0022] If any one of the third autonomous domains is different from the fourth autonomous domain, then the third flow specification entry is determined to be invalid;

[0023] The third flow specification entry is the flow specification entry in the third entry group corresponding to the second destination address. The third autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous system is the autonomous system where the network device is located. The fourth autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of the first optimal entry corresponding to the second destination address. The first optimal entry is the entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0024] In one embodiment of this application, within the second entry group corresponding to each first destination address, the unicast routing entries are arranged in ascending or descending order of the value of the highest-order identifier in the Autonomous System Path (ASPATH), wherein the ASPATH contains the identifiers of the autonomous systems traversed during entry synchronization.

[0025] Determine whether any one in each third autonomous region is different from the fourth autonomous region in the following way:

[0026] If the identifiers of the first autonomous region and the second autonomous region are the same as the identifier of the third autonomous region, then each third autonomous region is determined to be the same as the fourth autonomous region.

[0027] Wherein, the first autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is first in the order of the second table entry group corresponding to the second destination address;

[0028] The second autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is last in the order of the second entry group corresponding to the second destination address;

[0029] The third autonomous domain identifier is the identifier of the highest bit in ASPATH within the first optimal entry corresponding to the second destination address.

[0030] In one embodiment of this application, the method further includes:

[0031] If there are a first entry group, a second entry group, and a third entry group corresponding to the third destination address of the newly added flow specification entry, then the newly added flow specification entry is added to the third entry group corresponding to the third destination address.

[0032] If the first entry group, the second entry group, and the third entry group corresponding to the third destination address do not exist, then the first entry group, the second entry group, and the third entry group corresponding to the third destination address are created.

[0033] If the source node of the newly added flow specification entry is different from that of the first optimal entry corresponding to the third destination address, or if any one of the fifth autonomous domains is different from the sixth autonomous domain, then the newly added flow specification entry is determined to be invalid.

[0034] Wherein, the first optimal entry corresponding to the third destination address is: an entry that matches the third destination address, determined from the first entry group corresponding to the third destination address according to the longest mask matching principle; the source node is another network device that initiates entry synchronization to the network device; the fifth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing each second unicast routing entry corresponding to the third destination address; the current autonomous region is the autonomous region where the network device is located; and the sixth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing the first optimal entry corresponding to the third destination address.

[0035] In one embodiment of this application, the method further includes:

[0036] Determine the target flow specification entry, wherein the field in the target flow specification entry indicating that the source node has been updated, and the source node is another network device that initiated the entry synchronization to the network device;

[0037] If the first optimal entry corresponding to the fourth destination address of the target flow specification entry is different from the source node of the target flow specification entry, or if any one of the seventh autonomous domains is different from the eighth autonomous domain, then the target flow specification entry is determined to be invalid.

[0038] Wherein, the first optimal entry corresponding to the fourth destination address is: the entry that matches the fourth destination address, determined from the first entry group corresponding to the fourth destination address according to the longest mask matching principle; the seventh autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of each second unicast routing entry corresponding to the fourth destination address; the current autonomous region is the autonomous region where the network device is located; and the eighth autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of the first optimal entry corresponding to the fourth destination address.

[0039] Secondly, embodiments of this application provide a detection device applied to a network device, wherein the network device stores a first entry group, a second entry group, and a third entry group corresponding to each first destination address;

[0040] The first entry group includes: a first unicast routing entry, wherein the first destination address is located in the network segment corresponding to the destination address in the first unicast routing entry;

[0041] The second entry group includes: a second unicast routing entry, wherein the destination address in the second unicast routing entry is located in the network segment corresponding to the first destination address, and the destination address of the second unicast routing entry is different from the first destination address;

[0042] The third entry group includes: a flow specification entry whose destination address is the first destination address;

[0043] The device includes:

[0044] The unicast entry determination module is used to determine the target unicast entry that has changed. The destination address in the target unicast entry is the target address. The target unicast entry is a newly added unicast routing entry, or a unicast routing entry removed from the routing table, or a unicast routing entry whose information has been updated.

[0045] The second address determination module is used to obtain at least one second destination address from a plurality of first destination addresses based on the target address, wherein the second destination address is located in the network segment corresponding to the target address, or, if the target address is different from the second destination address, the target address is located in the network segment corresponding to the second destination address;

[0046] The first entry detection module is used to detect, for each second destination address, whether the flow specification entry in the third entry group corresponding to the second destination address is invalid, based on the first entry group and the second entry group corresponding to the second destination address.

[0047] In one embodiment of this application, if the second destination address is located in the network segment corresponding to the target address, the first entry detection module is specifically used for:

[0048] For each second destination address, update the first entry group corresponding to that second destination address based on the target unicast entry;

[0049] When the first optimal entry in the first entry group is updated, the first flow specification entry corresponding to the first optimal entry is determined to be invalid. The first flow specification entry contains the second destination address and is different from the source node of the first optimal entry. The source node is another network device that initiates entry synchronization to the network device. The first optimal entry is: an entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0050] If any one of the first autonomous domains is different from the second autonomous domain, then the second flow specification entry is determined to be invalid. The second flow specification entry is: other flow specification entries in the third entry group corresponding to the second destination address, excluding the first flow specification entry. The first autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous domain is the autonomous domain where the network device is located. The second autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of the first optimal entry corresponding to the second destination address.

[0051] In one embodiment of this application, in the first entry group corresponding to each first destination address, based on the longest mask matching principle, unicast routing entries are arranged in descending order of matching degree with the first destination address. The following module determines whether the first optimal entry in the first entry group has been updated:

[0052] The entry change determination module is used to determine if the first optimal entry in the first entry group has been updated if the unicast routing entry that is first in the order of the first entry group has been updated.

[0053] In one embodiment of this application, if the target address is different from the second destination address, and the target address is located in the network segment corresponding to the second destination address, the first entry detection module is specifically used for:

[0054] For each second destination address, update the second entry group corresponding to that second destination address based on the target unicast entry;

[0055] If any one of the third autonomous domains is different from the fourth autonomous domain, then the third flow specification entry is determined to be invalid;

[0056] The third flow specification entry is the flow specification entry in the third entry group corresponding to the second destination address. The third autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous system is the autonomous system where the network device is located. The fourth autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of the first optimal entry corresponding to the second destination address. The first optimal entry is the entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0057] In one embodiment of this application, within the second entry group corresponding to each first destination address, the unicast routing entries are arranged in ascending or descending order of the value of the highest-order identifier in the Autonomous System Path (ASPATH), wherein the ASPATH contains the identifiers of the autonomous systems traversed during entry synchronization.

[0058] The following modules are used to determine whether any one of the third autonomous domains is different from the fourth autonomous domain:

[0059] The autonomous region determination module is used to determine that each third autonomous region is the same as the fourth autonomous region if the first autonomous region identifier and the second autonomous region identifier are the same as the third autonomous region identifier.

[0060] Wherein, the first autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is first in the order of the second table entry group corresponding to the second destination address;

[0061] The second autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is last in the order of the second entry group corresponding to the second destination address;

[0062] The third autonomous domain identifier is the identifier of the highest bit in ASPATH within the first optimal entry corresponding to the second destination address.

[0063] In one embodiment of this application, the apparatus further includes:

[0064] The entry addition module is used to add the new flow specification entry to the third entry group corresponding to the third destination address if there are a first entry group, a second entry group, and a third entry group corresponding to the third destination address of the new flow specification entry.

[0065] The table entry group construction module is used to create the first table entry group, the second table entry group, and the third table entry group corresponding to the third destination address if the first table entry group, the second table entry group, and the third table entry group corresponding to the third destination address do not exist.

[0066] The second entry detection module is used to determine that the new flow specification entry is invalid if the source node of the new flow specification entry is different from that of the first optimal entry corresponding to the third destination address, or if any one of the fifth autonomous domains is different from the sixth autonomous domain.

[0067] Wherein, the first optimal entry corresponding to the third destination address is: an entry that matches the third destination address, determined from the first entry group corresponding to the third destination address according to the longest mask matching principle; the source node is another network device that initiates entry synchronization to the network device; the fifth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing each second unicast routing entry corresponding to the third destination address; the current autonomous region is the autonomous region where the network device is located; and the sixth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing the first optimal entry corresponding to the third destination address.

[0068] In one embodiment of this application, the apparatus further includes:

[0069] The flow specification entry determination module is used to determine the target flow specification entry, wherein the field in the target flow specification entry indicating that the source node has been updated, and the source node is another network device that initiates entry synchronization to the network device;

[0070] The third entry detection module is used to determine that the target flow specification entry is invalid if the first optimal entry corresponding to the fourth destination address of the target flow specification entry is different from the source node of the target flow specification entry, or if any one of the seventh autonomous domains is different from the eighth autonomous domain.

[0071] Wherein, the first optimal entry corresponding to the fourth destination address is: the entry that matches the fourth destination address, determined from the first entry group corresponding to the fourth destination address according to the longest mask matching principle; the seventh autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of each second unicast routing entry corresponding to the fourth destination address; the current autonomous region is the autonomous region where the network device is located; and the eighth autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of the first optimal entry corresponding to the fourth destination address.

[0072] Thirdly, embodiments of this application provide a network device, the network device comprising:

[0073] processor;

[0074] transceiver;

[0075] A machine-readable storage medium storing machine-executable instructions that can be executed by the processor, and for each first destination address, storing a first entry group, a second entry group, and a third entry group corresponding to the first destination address;

[0076] The first entry group includes: a first unicast routing entry, wherein the first destination address is located in the network segment corresponding to the destination address in the first unicast routing entry;

[0077] The second entry group includes: a second unicast routing entry, wherein the destination address in the second unicast routing entry is located in the network segment corresponding to the first destination address, and the destination address of the second unicast routing entry is different from the first destination address;

[0078] The third entry group includes: a flow specification entry whose destination address is the first destination address;

[0079] The machine-executable instructions cause the processor to perform the following steps:

[0080] Identify the target unicast entry that has changed, wherein the destination address in the target unicast entry is the target address, and the target unicast entry is a newly added unicast routing entry, or a unicast routing entry removed from the routing table, or a unicast routing entry whose contained information has been updated.

[0081] Based on the target address, at least one second destination address is obtained from a plurality of first destination addresses, wherein the second destination address is located in the network segment corresponding to the target address, or, if the target address is different from the second destination address, the target address is located in the network segment corresponding to the second destination address;

[0082] For each second destination address, based on the first and second entry groups corresponding to the second destination address, check whether the flow specification entry in the third entry group corresponding to the second destination address is invalid.

[0083] In one embodiment of this application, if the second destination address is located in the network segment corresponding to the target address, the step of detecting whether the flow specification entry in the third entry group corresponding to the second destination address is invalid based on the first and second entry groups corresponding to the second destination address specifically includes:

[0084] Update the first entry group corresponding to the second destination address based on the target unicast entry;

[0085] When the first optimal entry in the first entry group is updated, the first flow specification entry corresponding to the first optimal entry is determined to be invalid. The first flow specification entry contains the second destination address and is different from the source node of the first optimal entry. The source node is another network device that initiates entry synchronization to the network device. The first optimal entry is: an entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0086] If any one of the first autonomous domains is different from the second autonomous domain, then the second flow specification entry is determined to be invalid. The second flow specification entry is: other flow specification entries in the third entry group corresponding to the second destination address, excluding the first flow specification entry. The first autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous domain is the autonomous domain where the network device is located. The second autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of the first optimal entry corresponding to the second destination address.

[0087] In one embodiment of this application, in the first entry group corresponding to each first destination address, based on the longest mask matching principle, unicast routing entries are arranged in descending order of matching degree with the first destination address, and the first optimal entry in the first entry group is determined to have been updated in the following way:

[0088] If the unicast routing entry that is first in the order of the first entry group is updated, then the first optimal entry in the first entry group is determined to have been updated.

[0089] In one embodiment of this application, if the target address is different from the second destination address and the target address is located in the network segment corresponding to the second destination address, the step of detecting whether the flow specification table entry in the third table entry group corresponding to the second destination address is invalid based on the first table entry group and the second table entry group corresponding to the second destination address specifically includes:

[0090] Update the second entry group corresponding to the second destination address based on the target unicast entry;

[0091] If any one of the third autonomous domains is different from the fourth autonomous domain, then the third flow specification entry is determined to be invalid;

[0092] The third flow specification entry is the flow specification entry in the third entry group corresponding to the second destination address. The third autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous system is the autonomous system where the network device is located. The fourth autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of the first optimal entry corresponding to the second destination address. The first optimal entry is the entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0093] In one embodiment of this application, within the second entry group corresponding to each first destination address, the unicast routing entries are arranged in ascending or descending order of the value of the highest-order identifier in the Autonomous System Path (ASPATH), wherein the ASPATH contains the identifiers of the autonomous systems traversed during entry synchronization.

[0094] Determine whether any one in each third autonomous region is different from the fourth autonomous region in the following way:

[0095] If the identifiers of the first autonomous region and the second autonomous region are the same as the identifier of the third autonomous region, then each third autonomous region is determined to be the same as the fourth autonomous region.

[0096] Wherein, the first autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is first in the order of the second table entry group corresponding to the second destination address;

[0097] The second autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is last in the order of the second entry group corresponding to the second destination address;

[0098] The third autonomous domain identifier is the identifier of the highest bit in ASPATH within the first optimal entry corresponding to the second destination address.

[0099] In one embodiment of this application, the machine-executable instructions further cause the processor to perform the following steps:

[0100] If there are a first entry group, a second entry group, and a third entry group corresponding to the third destination address of the newly added flow specification entry, then the newly added flow specification entry is added to the third entry group corresponding to the third destination address.

[0101] If the first entry group, the second entry group, and the third entry group corresponding to the third destination address do not exist, then the first entry group, the second entry group, and the third entry group corresponding to the third destination address are created.

[0102] If the source node of the newly added flow specification entry is different from that of the first optimal entry corresponding to the third destination address, or if any one of the fifth autonomous domains is different from the sixth autonomous domain, then the newly added flow specification entry is determined to be invalid.

[0103] Wherein, the first optimal entry corresponding to the third destination address is: an entry that matches the third destination address, determined from the first entry group corresponding to the third destination address according to the longest mask matching principle; the source node is another network device that initiates entry synchronization to the network device; the fifth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing each second unicast routing entry corresponding to the third destination address; the current autonomous region is the autonomous region where the network device is located; and the sixth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing the first optimal entry corresponding to the third destination address.

[0104] In one embodiment of this application, the machine-executable instructions further cause the processor to perform the following steps:

[0105] Determine the target flow specification entry, wherein the field in the target flow specification entry indicating that the source node has been updated, and the source node is another network device that initiated the entry synchronization to the network device;

[0106] If the first optimal entry corresponding to the fourth destination address of the target flow specification entry is different from the source node of the target flow specification entry, or if any one of the seventh autonomous domains is different from the eighth autonomous domain, then the target flow specification entry is determined to be invalid.

[0107] Wherein, the first optimal entry corresponding to the fourth destination address is: the entry that matches the fourth destination address, determined from the first entry group corresponding to the fourth destination address according to the longest mask matching principle; the seventh autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of each second unicast routing entry corresponding to the fourth destination address; the current autonomous region is the autonomous region where the network device is located; and the eighth autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of the first optimal entry corresponding to the fourth destination address.

[0108] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the methods described in the first aspect.

[0109] Fifthly, embodiments of this application also provide a computer program product containing instructions that, when run on a computer, cause the computer to perform any of the steps described in the first aspect above.

[0110] Beneficial effects of the embodiments in this application:

[0111] The detection method provided in this application uses a first entry group, a second entry group, and a third entry group corresponding to the first destination address. Unicast routing entries and flow specification entries associated with the first destination address are recorded separately in the form of entry groups. In the event of a changed target unicast entry, the second destination address can be quickly located. The second destination address is located in the network segment corresponding to the target address, or the target address is located in the network segment corresponding to the second destination address. The validity of flow specification entries with the second destination address as the destination address may be affected by the target unicast entry. Unicast routing entries related to flow specification entries with the second destination address are all in the first and second entry groups corresponding to the second destination address. Therefore, it is only necessary to use the first and second entry groups corresponding to the second destination address to detect the entries in the third entry group. Thus, when unicast routing entries change, the scheme provided in this application only requires detecting a portion of the flow specification entries based on a portion of the unicast routing entries, which can greatly reduce the number of entries that need to be processed during detection and improve detection efficiency. Attached Figure Description

[0112] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0113] Figure 1 This is a flowchart illustrating the first detection method as shown in the embodiments of this application;

[0114] Figure 2 A schematic flowchart of the second detection method provided in the embodiments of this application;

[0115] Figure 3 A flowchart illustrating the third detection method provided in this application embodiment;

[0116] Figure 4 A flowchart illustrating the fourth detection method provided in this application embodiment;

[0117] Figure 5 A flowchart illustrating the fifth detection method provided in this application embodiment;

[0118] Figure 6 This application provides a schematic diagram of the structure of a network device according to an embodiment of the present application.

[0119] Figure 7 This is a schematic diagram of the structure of a detection device provided in an embodiment of this application. Detailed Implementation

[0120] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0121] To better illustrate the difference between this application and related technologies, the related technologies will be described first.

[0122] Related Technology 1: Whenever a BGP unicast routing table entry changes, all flow specification entries containing the destination address are re-checked. Since this check requires comparing each flow specification entry with each unicast routing table entry individually, it necessitates traversing all flow specification entries and then traversing all unicast routing table entries for each flow specification entry. This consumes significant CPU and memory resources. If both the number of unicast routing entries and flow specification entries are large, this will consume substantial computing resources, leading to performance degradation and impacting normal network operations. Therefore, one related technology uses a loop timer to periodically (e.g., every 60 seconds) check for changes in unicast routing table entries; if changes are found, the flow specification entries are re-checked.

[0123] While the above methods reduce the consumption of device computing resources, they cannot immediately respond to changes in unicast routing table entries, which slows down the convergence speed of flow specification entry validity checks. Furthermore, if changes to unicast routing table entries are detected during periodic checks, all flow specification entries containing destination addresses need to be re-traversed, resulting in continued low efficiency.

[0124] Related Technique 2: A radix tree is built using the destination address in the flow specification table as an index, or a hash table is built using the hash value of the destination address as an index. Each node in the radix tree corresponds to a destination address, and each entry in the hash table corresponds to a destination address. Flow specification entries with the same destination address are grouped into a storage structure, thus recording flow specification entries with the same destination address in the same storage structure. If a subsequent unicast routing entry changes, it is only necessary to query which destination addresses corresponding to the radix tree or hash table are affected by the change in the unicast routing entry, and then only the flow specification entries in the storage structure corresponding to those destination addresses need to be re-checked for invalidity. This reduces the number of flow specification entries that need to be checked, thereby improving the efficiency of flow specification entry invalidity checks.

[0125] However, although the second related technique can quickly find the flow specification entries that need to be checked, it is still relatively inefficient to check each flow specification entry by traversing all unicast routing entries.

[0126] To address the above problems, this application provides a detection method and apparatus.

[0127] This application embodiment applies to a network device, which stores a first entry group, a second entry group, and a third entry group corresponding to each first destination address. The first destination address is the destination address in the flow specification table of the network device.

[0128] In one embodiment of this application, a radix tree can be constructed, where each node at a radix number corresponds to a first destination address. A first entry group, a second entry group, and a third entry group are created at each node. Alternatively, a hash table can be constructed, where each entry records the hash value of a first destination address. A first entry group, a second entry group, and a third entry group are created within each entry. The aforementioned first entry group, second entry group, and third entry group can be in the form of a linked list, queue, stack, etc.

[0129] The aforementioned first entry group includes: a first unicast routing table entry. The aforementioned first destination address is located in the network segment corresponding to the destination address in the first unicast routing table entry. The network segment corresponding to the destination address in the first unicast routing table entry includes cases where the first destination address is the same as the destination address in the first unicast routing table entry.

[0130] The nodes in the first entry group mentioned above can directly record the corresponding first unicast routing table entry, or they can record the address of the corresponding first unicast routing table entry.

[0131] The aforementioned second entry group includes entries where the destination address in the second unicast routing table entry is located within the network segment corresponding to the first destination address, and the destination address of the second unicast routing table entry is different from the first destination address. Nodes in the aforementioned second entry group can directly record the corresponding second unicast routing table entry, or they can record the address of the corresponding second unicast routing table entry.

[0132] It should be noted that if the network device is configured with BGP route optimization rules, only the preferred route entries that conform to the BGP route optimization rules will play a role when the network device forwards packets and will affect the validity of the flow specification entries. Therefore, the first and second entry groups in this application may only contain preferred route entries that conform to the above provisions.

[0133] The aforementioned third entry group contains flow specification entries whose destination address is the first destination address. Nodes in the aforementioned third entry group can directly record the corresponding flow specification entry, or they can record the address of the corresponding flow specification entry.

[0134] See Figure 1 The above is a flowchart illustrating the first detection method mentioned in the embodiments of this application. The method includes the following steps S101-S103.

[0135] S101: Identify the target unicast entry that has been changed.

[0136] In this context, the destination address in the aforementioned target unicast entry is the target address, and the aforementioned target unicast entry is either a newly added unicast routing entry, a unicast routing entry removed from the routing table, or a unicast routing entry whose contained information has been updated.

[0137] If the first and second entry groups contain only preferred routing entries, then the target unicast entry is a unicast routing entry that has been added as a preferred routing entry, or a unicast routing entry that has been removed from the preferred routing entries (including unicast routing entries that were originally preferred but are no longer preferred after being updated, and unicast routing entries that have been deleted), or a preferred routing entry whose information has been updated.

[0138] S102: Based on the above target address, obtain at least one second destination address from a plurality of first destination addresses.

[0139] Wherein, the second destination address is located in the network segment corresponding to the target address, or, if the target address is different from the second destination address, the target address is located in the network segment corresponding to the second destination address.

[0140] S103: For each second destination address, based on the first and second entry groups corresponding to the second destination address, check whether the flow specification entry in the third entry group corresponding to the second destination address is invalid.

[0141] If a second destination address exists, then step S103 is executed; otherwise, step S103 is not executed.

[0142] In one embodiment of this application, the invalidity of a flow specification entry in the third entry group is determined according to the following rules.

[0143] Rule 1: For a flow specification entry, the source node of that flow specification entry must be the same as the source node of the third unicast routing entry. Following the longest mask matching principle, a match is made between the destination address of this flow specification entry and the fourth unicast routing entry; the match is the third unicast routing entry. The destination address of this flow specification entry must be within the network segment corresponding to the destination address of the fourth unicast routing entry. This ensures that a usable third unicast routing entry exists in the network device, allowing traffic regulated by the policy specified by the flow specification entry detected by Rule 1 to reach the targeted device.

[0144] Rule 2: A fifth unicast routing entry is not allowed. A fifth unicast routing entry and the third unicast routing entry corresponding to the flow specification entry being inspected must originate from different neighboring autonomous systems (AS), and its destination address must be within the network segment corresponding to the destination address of the flow specification entry being inspected, and its destination address must be different from the destination address of the flow specification entry being inspected. Because the fifth unicast routing entry is contained within the network segment corresponding to the destination address of the flow specification entry, its destination address is more specific than the flow specification entry's destination address. The flow specification entry cannot restrict traffic forwarded according to the more specific fifth unicast routing entry. Furthermore, because the fifth and third unicast routing entries originate from different neighboring ASes, the fifth unicast routing entry may redirect traffic to other neighboring ASes, posing a security risk. Therefore, when a fifth unicast routing entry exists, the flow specification entry being inspected is invalid.

[0145] In this embodiment, the destination addresses of all flow specification entries in the third entry group are the second destination address. The first entry group corresponding to the second destination address contains all first unicast routing entries corresponding to the second destination address, and the second destination address is located in the network segment corresponding to the destination address in the first unicast routing entry. Therefore, for a flow specification entry with a destination address of the second destination address, the fourth unicast routing entry is the unicast routing entry in the first entry group. The third unicast routing entry is the first optimal entry in the first entry group. The first optimal entry is the entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0146] Therefore, for the flow specification entries in the third entry group corresponding to the second destination address, it is only necessary to compare each flow specification entry with the first optimal entry in the first entry group according to the source node. Unicast routing entries with different source nodes are invalid.

[0147] The aforementioned source nodes are other network devices that initiate table entry synchronization to this network device. In one scenario, the Autonomous System (AS) does not enable RFC 4456 reflection; in this case, the source node is the network device's BGP neighbor, and the table entry is synchronized by the BGP neighbor to this network device. The source node is the network device corresponding to the neighbor address recorded in the table entry. In another scenario, network devices within the same AS domain enable RFC 4456 reflection, meaning all network devices in the same AS domain are BGP neighbors of the same network device (e.g., network device A). In this case, if network device B needs to synchronize a table entry to network device C, network device B will first synchronize the entry with network device A, and then network device A will synchronize the entry with network device C. In this case, the synchronized table entry will carry a source (ORIGINATOR_ID) field, which contains the identifier of network device B, indicating that the network device that initiated the table entry synchronization to network device A is network device B.

[0148] Therefore, if both the unicast routing table entry and the flow specification entry being compared carry a source field, the source fields are compared to see if they are the same. If they are the same, it is determined that the source node of the unicast routing table entry and the flow specification entry is the same. If at least one of the unicast routing table entry and the flow specification entry being compared does not carry a source field, the address of the BGP neighbor synchronizing the entry to the network device is determined by the neighbor address attribute value recorded in the entry. The addresses of the BGP neighbors carried by both entries are compared to see if they are the same. If they are the same, it is determined that the BGP neighbors synchronizing the two entries to the network device are the same, that is, it is determined that the source node of the unicast routing table entry and the flow specification entry is the same.

[0149] If none of the flow specification entries in the third entry group corresponding to the second destination address conform to rule 1 above, then there is no need to continue the subsequent detection. It can be directly determined that all flow specification entries in the third entry group corresponding to the second destination address are invalid, thereby saving the computing resources consumed by the detection.

[0150] If there is a flow specification entry that meets rule 1 in the third entry group corresponding to the second destination address, then continue the detection based on rule 2.

[0151] Consider the following scenario: a unicast routing table entry is synchronized from network device A to network device B, and then from network device B to network device C. Network device A is located in Autonomous System 1, network device B in Autonomous System 2, and network device C in Autonomous System 3. Then, for network device B, the neighboring Autonomous System of this unicast routing table entry is Autonomous System 1; for network device C, the neighboring Autonomous System is Autonomous System 2. A neighboring Autonomous System is defined as the last Autonomous System traversed during entry synchronization that is different from the current Autonomous System. The current Autonomous System is the Autonomous System where the network device storing the entry resides. To record the Autonomous Systems traversed during unicast routing table entry synchronization, the unicast routing table entry contains an ASPATH (Autonomous System Path) field. The ASPATH field value in the unicast routing table entry recorded in network device B is 1, indicating that the unicast routing table entry was synchronized from Autonomous System 1. In network device C, the ASPATH field of the unicast routing table entry is set to 21. This means that the identifier 2 for Autonomous System 2 is added to the high-order bits of the ASPATH field recorded in network device B, indicating that the unicast routing table entry is synchronized to network device C sequentially through Autonomous System 1 and Autonomous System 2. For each network device, by querying the identifier in the highest-order bit of the ASPATH field, it can be determined which Autonomous System is the neighboring Autonomous System for that unicast routing table entry.

[0152] In another example, if a unicast routing table entry is synchronized from network device A to network device B, and then from network device B to network device C, and if network devices A, B, and C are all located in the same autonomous system (AS), then there are no neighboring AS systems. In this case, the ASPATH field value in the unicast routing table entry stored in network devices A, B, and C will all be empty.

[0153] Therefore, the neighbor autonomous system corresponding to a unicast routing table entry can be determined based on the highest-order identifier (which can be called LeftAS) in the ASPATH of the unicast routing table entry.

[0154] In one embodiment of this application, the unicast routing entries in the second entry group corresponding to the second destination address can be traversed sequentially to determine whether their neighbor autonomous systems are the same as the neighbor autonomous systems of the first optimal entry in the first entry group corresponding to the second destination address. If any of them are different, then all flow specification entries in the third entry group corresponding to the second destination address are determined to be invalid.

[0155] As can be seen from the above, this application uses a first entry group, a second entry group, and a third entry group corresponding to the first destination address to record unicast routing entries and flow specification entries associated with the first destination address in the form of entry groups. In the event of a changed target unicast entry, the second destination address can be quickly located. The second destination address is located in the network segment corresponding to the target address, or the target address is located in the network segment corresponding to the second destination address. The validity of flow specification entries with the second destination address as the destination address may be affected by the target unicast entry. Unicast routing entries related to flow specification entries with the second destination address are all in the first and second entry groups corresponding to the second destination address. Therefore, it is only necessary to use the first and second entry groups corresponding to the second destination address to detect the entries in the third entry group. Thus, when unicast routing entries change, the scheme provided by this application only requires detecting a portion of the flow specification entries based on a portion of the unicast routing entries, which can greatly reduce the number of entries that need to be processed during detection and improve detection efficiency.

[0156] See Figure 2 This is a flowchart illustrating the second detection method provided in this application embodiment. For the second destination address in the network segment corresponding to the destination address of the above-mentioned target unicast table entry, the above-mentioned step S103 is implemented through the following steps S103A-S103C.

[0157] S103A: Update the first entry group corresponding to the second destination address based on the above target unicast entry.

[0158] If the target unicast entry is a newly added unicast routing entry, then add the target unicast entry to the first entry group.

[0159] If the target unicast entry is a unicast routing entry removed from the routing table, then the target unicast entry is removed from the first entry group.

[0160] If the target unicast entry is a unicast routing entry whose contained information has been updated, then if the node in the first entry group directly records the first unicast routing entry, the target unicast entry recorded in the first entry group will be updated; if the node in the first entry group records the address of the first unicast routing entry, the first entry group will remain unchanged.

[0161] S103B: When the first optimal entry in the first entry group is updated, the first flow specification entry corresponding to the first optimal entry is determined to be invalid.

[0162] The first stream specification entry contains the second destination address and is different from the source node of the first optimal entry. The source node is another network device that initiates entry synchronization to the network device. The first optimal entry is the entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0163] S103C: If any one of the first autonomous domains is different from the second autonomous domain, then the second flow specification entry is determined to be invalid.

[0164] Wherein, the aforementioned second flow specification entry is: other flow specification entries in the third entry group corresponding to the second destination address, excluding the aforementioned first flow specification entry; the aforementioned first autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address; the aforementioned current autonomous domain is the autonomous domain where the aforementioned network device is located; and the aforementioned second autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of the first optimal entry corresponding to the second destination address.

[0165] As seen in Rules 1 and 2 above, both rules compare the entry with the first optimal entry corresponding to the second destination address to determine whether the flow specification entry in the third entry group is invalid. Therefore, if the target unicast entry causes the first optimal entry in the first entry group to be updated, this update may change the validity of the flow specification entry in the third entry group, thus requiring subsequent validity checks. Therefore, in this embodiment, steps S103B and S103C are executed when the first optimal entry in the first entry group is updated. Conversely, if the target unicast entry does not cause an update to the first optimal entry, it will not change the validity of the flow specification entry in the third entry group, and therefore, subsequent validity checks are unnecessary.

[0166] There are three possible scenarios that would cause the first optimal entry in the first entry group corresponding to the second destination address to be updated due to the target unicast entry.

[0167] Scenario 1: The target unicast entry is a newly added unicast routing entry, which is added to the first entry group and becomes the new first best entry.

[0168] Scenario 2: The destination unicast entry is a unicast routing entry that has been removed from the routing table. The destination unicast entry was originally the first best entry in the first entry group corresponding to the second destination address. Since it has been deleted, the first best entry in the first entry group has changed.

[0169] Scenario 3: The information contained in the target unicast entry is updated, and the target unicast entry is the first optimal entry in the first entry group corresponding to the second destination address.

[0170] If the first optimal entry is updated, the validity of each flow specification entry in the third entry group is re-checked based on the method described in step S103 above. The specific implementation method will not be described here.

[0171] In one embodiment of this application, the identifier of the last autonomous system (AS) different from the current AS of the first optimal entry in the first entry group can be recorded separately, i.e., the highest-order identifier in the ASPATH of the first optimal entry. When the first optimal entry includes a source field, recording the source field separately facilitates direct detection of the validity of the flow specification entry based on the recorded highest-order identifier and source field, without needing to re-determine the highest-order identifier and source field during detection. Furthermore, a judgment result field indicating whether each first AS is identical to the second AS can be recorded separately. Then, when the unicast routing entries in the first optimal entry and the second entry group have not changed, regardless of how the flow specification entries in the third entry group change, it is possible to directly determine whether the first AS is identical to the second AS based on this judgment result field, thereby directly completing the judgment of rule 2 without needing to re-judge, which can improve detection efficiency.

[0172] Furthermore, if the information contained in the target unicast entry is updated, and the target unicast entry is the first optimal entry in the first entry group, and the updated information is the source field or ASPATH, then as can be seen from the aforementioned rules 1 and 2, the above update will affect the validity of the flow specification entry. In this case, the validity of the flow specification entry can be re-checked. If other information is updated, there is no need to re-check the validity.

[0173] In one embodiment of this application, in the first entry group corresponding to each first destination address, based on the longest mask matching principle, unicast routing entries are arranged in descending order of matching degree with the first destination address. Then, for each first destination address, the first unicast routing entry in the first entry group corresponding to the first destination address is the first optimal entry in the first entry group.

[0174] Therefore, it can be determined whether the first optimal entry in the first entry group has been updated based on the following step A.

[0175] Step A: If the unicast routing entry that is first in the order of the first entry group is updated, then the first optimal entry in the first entry group is determined to have been updated.

[0176] Specifically, if the target unicast entry is a newly added unicast routing entry, then if the target unicast entry is added to the beginning of the first entry group corresponding to the second destination address, then the first optimal entry is determined to have been updated.

[0177] If the aforementioned target unicast entry is a unicast routing entry removed from the routing table, then if the aforementioned target unicast entry was originally located at the beginning of the first entry group corresponding to the second destination address, then the first optimal entry is determined to have been updated. The updated first optimal entry is the unicast routing entry that was originally located in the second position.

[0178] If the information contained in the aforementioned target unicast entry is updated, then if the aforementioned target unicast entry is at the beginning of the first entry group corresponding to the second destination address, then it is determined that the first optimal entry has been updated.

[0179] If the first entry group is constructed using this embodiment, it is possible to determine whether the first optimal entry has been updated simply by directly judging whether the unicast routing entry at the top and bottom of the first entry group has been updated. The determination method is relatively simple and does not require traversing the first entry group to find the first optimal entry.

[0180] As can be seen from the above, in this embodiment, the validity of the flow specification entry in the third entry group corresponding to the second destination address is re-checked only when the first optimal entry corresponding to the first entry group is updated. Otherwise, the validity check is not performed, which can further save the number of validity checks and further save computing resources.

[0181] See Figure 3 This is a flowchart illustrating the third detection method provided in this application embodiment, which is consistent with the aforementioned... Figure 1 Compared to the illustrated embodiment, if the target address is different from the second destination address and the target address is located in the network segment corresponding to the second destination address, then step S103 can be implemented by steps S103D-S103E.

[0182] S103D: Update the second entry group corresponding to the second destination address based on the above target unicast entry.

[0183] If the target unicast entry is a newly added unicast routing entry, then add the target unicast entry to the second entry group.

[0184] If the target unicast entry is a unicast routing entry removed from the routing table, then the target unicast entry is removed from the second entry group.

[0185] If the target unicast entry is the preferred routing entry whose contained information is updated, then if the node in the second entry group directly records the second unicast routing entry, the target unicast entry recorded in the second entry group is updated; if the node in the second entry group records the address of the second unicast routing entry, the second entry group remains unchanged.

[0186] Because in Figure 3 In the scenario shown, only the second entry group changes. As described above regarding rules 1 and 2, rule 1 is based on the detection of the first and third entry groups, while rule 2 is based on the detection of the first and second entry groups. Therefore, the detection result based on rule 1 is unrelated to the second entry group, and changes to the second entry group will not affect the detection result based on rule 1. Thus, in this case, the flow specification entries can be re-detected based solely on rule 2, and step S103E is executed.

[0187] S103E: If any one of the third autonomous domains is different from the fourth autonomous domain, then the third flow specification entry is determined to be invalid.

[0188] The aforementioned third flow specification entry is: the flow specification entry in the third entry group corresponding to the second destination address; the aforementioned third autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address; the aforementioned current autonomous region is the autonomous region where the aforementioned network device is located; the aforementioned fourth autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of the first optimal entry corresponding to the second destination address; the aforementioned first optimal entry is: the entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0189] Specifically, the method for determining whether a flow specification entry in the third entry group is invalid based on the third and fourth autonomous domains can be found in the description of step S103 above, and will not be repeated here.

[0190] It should be noted that if all third autonomous domains are the same as the fourth autonomous domain, the validity status of the third flow specification entries in the third entry group corresponding to the second destination address remains unchanged, that is, it is consistent with the result of the previous detection, rather than directly determining that all third flow specification entries corresponding to the second destination address are valid. However, if any one of the third autonomous domains is different from the fourth autonomous domain, then all third flow specification entries are directly determined to be invalid.

[0191] In one embodiment of this application, within the second entry group corresponding to each first destination address, the unicast routing entries are arranged in ascending or descending order of the value of the highest bit identifier in ASPATH, wherein the ASPATH contains the identifiers of the autonomous systems traversed during entry synchronization.

[0192] In this case, step B is used to determine whether any one of the third autonomous domains is different from the fourth autonomous domain.

[0193] Step B: If the identifiers of the first autonomous region and the second autonomous region are the same as the identifier of the third autonomous region, then determine that each third autonomous region is the same as the fourth autonomous region.

[0194] The first autonomous system identifier mentioned above is the highest-order identifier in the ASPATH of the unicast routing table entry that is first in the order of the second table entry group (specifically the updated second table entry group) corresponding to the second destination address.

[0195] The aforementioned second autonomous system identifier is the highest-order identifier in the ASPATH of the unicast routing table entry that is the last entry in the second table entry group corresponding to the second destination address.

[0196] The aforementioned third autonomous domain identifier is the identifier of the highest bit in ASPATH within the first optimal entry corresponding to the second destination address.

[0197] The order of unicast routing entries in the second entry group is related to the value of the highest-order identifier in the ASPATH. The closer to the first entry, the larger or smaller the value; in this case, the first autonomous system identifier is the highest-order identifier in the ASPATH of the first unicast routing entry in the second entry group. The second autonomous system identifier is the highest-order identifier in the ASPATH of the last unicast routing entry in the second entry group. Therefore, the first and second autonomous system identifiers should be the two extreme values ​​of the highest-order identifier in the ASPATH of all unicast routing entries in the second entry group. If the first and second autonomous system identifiers are the same, it means that the maximum and minimum values ​​of the highest-order identifier in the ASPATH of all unicast routing entries in the entire second link are the same, that is, the highest-order identifier in the ASPATH of all unicast routing entries is the same.

[0198] Based on this, if both the first and second autonomous domain identifiers are the same as the highest-order identifier in the ASPATH of the second optimal entry (i.e., the third autonomous domain identifier), then it means that the third autonomous domain corresponding to all unicast routing entries in the second entry group is the same as the fourth autonomous domain.

[0199] Therefore, when constructing the second entry group using this embodiment, when checking the validity of the flow specification entries in the third entry group, it is only necessary to compare the three autonomous domain identifiers. It is not necessary to traverse the entire second entry group and sequentially determine whether the third autonomous domain of all unicast routing entries in the second entry group is the same as the fourth autonomous domain, which can save more computation.

[0200] It should be noted that if ASPATH in a unicast routing table entry is empty, then its highest-order identifier will also be empty. If the first autonomous system identifier, the second autonomous system identifier, and the third autonomous system identifier are all empty, then the first autonomous system identifier, the second autonomous system identifier, and the third autonomous system identifier are considered to be the same.

[0201] As can be seen from the above, when detecting flow specification entries using this embodiment, if the second entry group corresponding to the second destination address is updated, it is only necessary to compare the third autonomous region and the fourth autonomous region based on the first and second entry groups to determine whether the invalid state of the flow specification entry in the third entry corresponding to the second destination address needs to be updated. This process involves only the comparison of a small number of unicast routing entries in the first and second entry groups, and may not even involve the comparison of flow specification entries in the third entry group. Therefore, the computational resources consumed are relatively small.

[0202] See Figure 4 This is a flowchart illustrating the fourth detection method provided in this application embodiment, which is consistent with the aforementioned... Figure 1 Compared to the illustrated embodiment, the steps S104-S106 are also included.

[0203] S104: If there are a first entry group, a second entry group, and a third entry group corresponding to the third destination address of the newly added flow specification entry, then add the newly added flow specification entry to the third entry group corresponding to the third destination address.

[0204] S105: If the first, second, and third entry groups corresponding to the aforementioned third destination address do not exist, then create the first, second, and third entry groups corresponding to the aforementioned third destination address.

[0205] In this case, it is necessary to traverse the unicast routing table entries to determine the first unicast routing table entry corresponding to the third destination address, thereby constructing the first entry group, and then determine the second unicast routing table entry corresponding to the third destination address, thereby constructing the second entry group. The third entry group contains the newly added flow specification entries.

[0206] S106: If the source node of the newly added flow specification entry is different from that of the first optimal entry corresponding to the third destination address, or if any one of the fifth autonomous domains is different from the sixth autonomous domain, then the newly added flow specification entry is determined to be invalid.

[0207] The first optimal entry corresponding to the third destination address is: the entry that matches the third destination address, determined from the first entry group corresponding to the third destination address according to the longest mask matching principle. The source node is another network device that initiates entry synchronization to the network device. The fifth autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through when synchronizing each second unicast routing entry corresponding to the third destination address. The current autonomous domain is the autonomous domain where the network device is located. The sixth autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through when synchronizing the first optimal entry corresponding to the third destination address.

[0208] Specifically, the method of implementing step S106 is similar to that of step S103 mentioned above, and will not be repeated here.

[0209] It should be noted that if there are first, second, and third entry groups corresponding to the third destination address of a newly added flow specification entry, the new flow specification entry is added to the third entry group. Since Rule 2 is based on the first and second entry groups, inserting a new flow specification entry into the third entry group will not affect the judgment result of Rule 2. Therefore, if the first entry group corresponding to the third destination address records the judgment result field mentioned above, it is possible to determine whether each fifth autonomous region is the same as the sixth autonomous region based on the judgment result field, thus eliminating the need to perform this judgment again and saving computation.

[0210] As can be seen from the above, this embodiment can insert the new flow specification entry into the existing third entry group, or construct new first, second, and third entry groups for the new flow specification entry, when a new flow specification entry exists, thereby detecting whether the new flow specification entry is valid. This process only needs to use the new flow specification entry and the unicast routing entries in the first and second entry groups corresponding to its third destination address, without traversing the unicast routing entries for detection. Therefore, it can also save computing resources when re-checking the validity of the new flow specification entry.

[0211] See Figure 5 This is a flowchart illustrating the fifth detection method provided in this application embodiment, which is consistent with the aforementioned... Figure 1 Compared to the illustrated embodiment, the steps S107-S108 are also included.

[0212] S107: Determine the target flow specification entries.

[0213] The field indicating the source node in the target flow specification entry above has been updated. The source node is another network device that initiated the entry synchronization to this network device.

[0214] As seen from the validity determination process of flow specification entries described above, the validity of a flow specification entry is only determined using its source node. Therefore, only an update to the field representing the source node in the flow specification entry will affect the validity of the flow specification entry. Therefore, this application needs to identify the target flow specification entries whose source node field has been updated and re-evaluate them.

[0215] S108: If the first optimal entry corresponding to the fourth destination address of the above target flow specification entry is different from the source node of the above target flow specification entry, or if any one of the seventh autonomous domains is different from the eighth autonomous domain, then the above target flow specification entry is determined to be invalid.

[0216] The first optimal entry corresponding to the fourth destination address is: the entry that matches the fourth destination address, determined from the first entry group corresponding to the fourth destination address according to the longest mask matching principle. The seventh autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of each second unicast routing entry corresponding to the fourth destination address. The current autonomous region is the autonomous region where the network device is located. The eighth autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of the first optimal entry corresponding to the fourth destination address.

[0217] Specifically, the method of implementing step S108 is similar to that of step S103 mentioned above, and will not be repeated here.

[0218] It should be noted that since Rule 2 is based on the first and second table entry groups, changes in the information contained in the target flow specification entries in the third table entry group will not affect the judgment result of Rule 2. Therefore, if the first table entry group corresponding to the fourth destination address contains the judgment result field mentioned above, it is possible to determine whether each seventh autonomous region is the same as the eighth autonomous region based on the judgment result field, thus eliminating the need to perform this judgment again and saving computation.

[0219] As can be seen from the above, this embodiment can re-detect the validity of a target flow specification entry even when such an entry exists. This process only requires using the target flow specification entry and the unicast routing entries in the first and second entry groups corresponding to its fourth destination address, without traversing all unicast routing entries. Therefore, it can also save computational resources when re-detecting the validity of the target flow specification entry.

[0220] Corresponding to the aforementioned detection methods applied to network devices, this application also provides a network device.

[0221] See Figure 6This is a schematic diagram of the structure of a network device provided in an embodiment of this application. The network device includes:

[0222] Processor 601;

[0223] Transceiver 604;

[0224] The machine-readable storage medium 602 stores machine-executable instructions that can be executed by the processor 601, and for each first destination address, stores a first entry group, a second entry group, and a third entry group corresponding to the first destination address.

[0225] The first entry group includes: a first unicast routing entry, wherein the first destination address is located in the network segment corresponding to the destination address in the first unicast routing entry;

[0226] The second entry group includes: a second unicast routing entry, wherein the destination address in the second unicast routing entry is located in the network segment corresponding to the first destination address, and the destination address of the second unicast routing entry is different from the first destination address;

[0227] The third entry group includes: a flow specification entry whose destination address is the first destination address;

[0228] The machine-executable instructions cause the processor 601 to perform the following steps:

[0229] Identify the target unicast entry that has changed, wherein the destination address in the target unicast entry is the target address, and the target unicast entry is a newly added unicast routing entry, or a unicast routing entry removed from the routing table, or a unicast routing entry whose contained information has been updated.

[0230] Based on the target address, at least one second destination address is obtained from a plurality of first destination addresses, wherein the second destination address is located in the network segment corresponding to the target address, or, if the target address is different from the second destination address, the target address is located in the network segment corresponding to the second destination address;

[0231] For each second destination address, based on the first and second entry groups corresponding to the second destination address, check whether the flow specification entry in the third entry group corresponding to the second destination address is invalid.

[0232] like Figure 6As shown, the network device may also include a communication bus 603. The processor 601, machine-readable storage medium 602, and transceiver 604 communicate with each other via the communication bus 603. The communication bus 603 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus 603 can be divided into an address bus, a data bus, a control bus, etc.

[0233] The transceiver 604 can be a wireless communication module. Under the control of the processor 601, the transceiver 604 interacts with other devices for data exchange.

[0234] Machine-readable storage medium 602 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Alternatively, machine-readable storage medium 602 may also be at least one storage device located remotely from the aforementioned processor.

[0235] The processor 601 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0236] As can be seen from the above, this application uses a first entry group, a second entry group, and a third entry group corresponding to the first destination address to record unicast routing entries and flow specification entries associated with the first destination address in the form of entry groups. In the event of a changed target unicast entry, the second destination address can be quickly located. The second destination address is located in the network segment corresponding to the target address, or the target address is located in the network segment corresponding to the second destination address. The validity of flow specification entries with the second destination address as the destination address may be affected by the target unicast entry. Unicast routing entries related to flow specification entries with the second destination address are all in the first and second entry groups corresponding to the second destination address. Therefore, it is only necessary to use the first and second entry groups corresponding to the second destination address to detect the entries in the third entry group. Thus, when unicast routing entries change, the scheme provided by this application only requires detecting a portion of the flow specification entries based on a portion of the unicast routing entries, which can greatly reduce the number of entries that need to be processed during detection and improve detection efficiency.

[0237] In one embodiment of this application, if the second destination address is located in the network segment corresponding to the target address, the step of detecting whether the flow specification entry in the third entry group corresponding to the second destination address is invalid based on the first and second entry groups corresponding to the second destination address specifically includes:

[0238] Update the first entry group corresponding to the second destination address based on the target unicast entry;

[0239] When the first optimal entry in the first entry group is updated, the first flow specification entry corresponding to the first optimal entry is determined to be invalid. The first flow specification entry contains the second destination address and is different from the source node of the first optimal entry. The source node is another network device that initiates entry synchronization to the network device. The first optimal entry is: an entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0240] If any one of the first autonomous domains is different from the second autonomous domain, then the second flow specification entry is determined to be invalid. The second flow specification entry is: other flow specification entries in the third entry group corresponding to the second destination address, excluding the first flow specification entry. The first autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous domain is the autonomous domain where the network device is located. The second autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of the first optimal entry corresponding to the second destination address.

[0241] As can be seen from the above, in this embodiment, the validity of the flow specification entry in the third entry group corresponding to the second destination address is re-checked only when the first optimal entry corresponding to the first entry group is updated. Otherwise, the validity check is not performed, which can further save the number of validity checks and further save computing resources.

[0242] In one embodiment of this application, in the first entry group corresponding to each first destination address, based on the longest mask matching principle, unicast routing entries are arranged in descending order of matching degree with the first destination address, and the first optimal entry in the first entry group is determined to have been updated in the following way:

[0243] If the unicast routing entry that is first in the order of the first entry group is updated, then the first optimal entry in the first entry group is determined to have been updated.

[0244] As can be seen from the above, if the first entry group is constructed using this embodiment, it is possible to determine whether the first optimal entry has been updated simply by directly judging whether the unicast routing entry at the top and bottom of the first entry group has been updated. The determination method is relatively simple and does not require traversing the first entry group to find the first optimal entry.

[0245] In one embodiment of this application, if the target address is different from the second destination address and the target address is located in the network segment corresponding to the second destination address, the step of detecting whether the flow specification table entry in the third table entry group corresponding to the second destination address is invalid based on the first table entry group and the second table entry group corresponding to the second destination address specifically includes:

[0246] Update the second entry group corresponding to the second destination address based on the target unicast entry;

[0247] If any one of the third autonomous domains is different from the fourth autonomous domain, then the third flow specification entry is determined to be invalid;

[0248] The third flow specification entry is the flow specification entry in the third entry group corresponding to the second destination address. The third autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous system is the autonomous system where the network device is located. The fourth autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of the first optimal entry corresponding to the second destination address. The first optimal entry is the entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0249] As can be seen from the above, when detecting flow specification entries using this embodiment, if the second entry group corresponding to the second destination address is updated, it is only necessary to compare the third autonomous region and the fourth autonomous region based on the first and second entry groups to determine whether the invalid state of the flow specification entry in the third entry corresponding to the second destination address needs to be updated. This process involves only the comparison of a small number of unicast routing entries in the first and second entry groups, and may not even involve the comparison of flow specification entries in the third entry group. Therefore, the computational resources consumed are relatively small.

[0250] In one embodiment of this application, within the second entry group corresponding to each first destination address, the unicast routing entries are arranged in ascending or descending order of the value of the highest-order identifier in the Autonomous System Path (ASPATH), wherein the ASPATH contains the identifiers of the autonomous systems traversed during entry synchronization.

[0251] Determine whether any one in each third autonomous region is different from the fourth autonomous region in the following way:

[0252] If the identifiers of the first autonomous region and the second autonomous region are the same as the identifier of the third autonomous region, then each third autonomous region is determined to be the same as the fourth autonomous region.

[0253] Wherein, the first autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is first in the order of the second table entry group corresponding to the second destination address;

[0254] The second autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is last in the order of the second entry group corresponding to the second destination address;

[0255] The third autonomous domain identifier is the identifier of the highest bit in ASPATH within the first optimal entry corresponding to the second destination address.

[0256] As can be seen from the above, when constructing the second entry group using this embodiment, it is only necessary to compare the three autonomous domain identifiers when checking the validity of the flow specification entries in the third entry group. It is not necessary to traverse the entire second entry group and sequentially determine whether the third autonomous domain of all unicast routing entries in the second entry group is the same as the fourth autonomous domain, which can save more computation.

[0257] In one embodiment of this application, the machine-executable instructions further cause the processor 601 to perform the following steps:

[0258] If there are a first entry group, a second entry group, and a third entry group corresponding to the third destination address of the newly added flow specification entry, then the newly added flow specification entry is added to the third entry group corresponding to the third destination address.

[0259] If the first entry group, the second entry group, and the third entry group corresponding to the third destination address do not exist, then the first entry group, the second entry group, and the third entry group corresponding to the third destination address are created.

[0260] If the source node of the newly added flow specification entry is different from that of the first optimal entry corresponding to the third destination address, or if any one of the fifth autonomous domains is different from the sixth autonomous domain, then the newly added flow specification entry is determined to be invalid.

[0261] Wherein, the first optimal entry corresponding to the third destination address is: an entry that matches the third destination address, determined from the first entry group corresponding to the third destination address according to the longest mask matching principle; the source node is another network device that initiates entry synchronization to the network device; the fifth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing each second unicast routing entry corresponding to the third destination address; the current autonomous region is the autonomous region where the network device is located; and the sixth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing the first optimal entry corresponding to the third destination address.

[0262] As can be seen from the above, this embodiment can insert the new flow specification entry into the existing third entry group, or construct new first, second, and third entry groups for the new flow specification entry, when a new flow specification entry exists, thereby detecting whether the new flow specification entry is valid. This process only needs to use the new flow specification entry and the unicast routing entries in the first and second entry groups corresponding to its third destination address, without traversing the unicast routing entries for detection. Therefore, it can also save computing resources when re-checking the validity of the new flow specification entry.

[0263] In one embodiment of this application, the machine-executable instructions further cause the processor 601 to perform the following steps:

[0264] Determine the target flow specification entry, wherein the field in the target flow specification entry indicating that the source node has been updated, and the source node is another network device that initiated the entry synchronization to the network device;

[0265] If the first optimal entry corresponding to the fourth destination address of the target flow specification entry is different from the source node of the target flow specification entry, or if any one of the seventh autonomous domains is different from the eighth autonomous domain, then the target flow specification entry is determined to be invalid.

[0266] Wherein, the first optimal entry corresponding to the fourth destination address is: the entry that matches the fourth destination address, determined from the first entry group corresponding to the fourth destination address according to the longest mask matching principle; the seventh autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of each second unicast routing entry corresponding to the fourth destination address; the current autonomous region is the autonomous region where the network device is located; and the eighth autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of the first optimal entry corresponding to the fourth destination address.

[0267] As can be seen from the above, this embodiment can re-detect the validity of a target flow specification entry even when such an entry exists. This process only requires using the target flow specification entry and the unicast routing entries in the first and second entry groups corresponding to its fourth destination address, without traversing all unicast routing entries. Therefore, it can also save computational resources when re-detecting the validity of the target flow specification entry.

[0268] Corresponding to the aforementioned detection methods applied to network devices, this application also provides a detection device applied to network devices.

[0269] See Figure 7 This is a schematic diagram of the structure of a detection device provided in an embodiment of this application. It is applied to a network device. The network device stores a first entry group, a second entry group, and a third entry group corresponding to each first destination address.

[0270] The first entry group includes: a first unicast routing entry, wherein the first destination address is located in the network segment corresponding to the destination address in the first unicast routing entry;

[0271] The second entry group includes: a second unicast routing entry, wherein the destination address in the second unicast routing entry is located in the network segment corresponding to the first destination address, and the destination address of the second unicast routing entry is different from the first destination address;

[0272] The third entry group includes: a flow specification entry whose destination address is the first destination address;

[0273] The device includes:

[0274] The unicast entry determination module 701 is used to determine the target unicast entry that has changed. The destination address in the target unicast entry is the target address. The target unicast entry is a newly added unicast routing entry, or a unicast routing entry removed from the routing table, or a unicast routing entry whose information has been updated.

[0275] The second address determination module 702 is used to obtain at least one second destination address from a plurality of first destination addresses based on the target address, wherein the second destination address is located in the network segment corresponding to the target address, or, if the target address is different from the second destination address, the target address is located in the network segment corresponding to the second destination address;

[0276] The first entry detection module 703 is used to detect, for each second destination address, whether the flow specification entry in the third entry group corresponding to the second destination address is invalid, based on the first entry group and the second entry group corresponding to the second destination address.

[0277] As can be seen from the above, this application uses a first entry group, a second entry group, and a third entry group corresponding to the first destination address to record unicast routing entries and flow specification entries associated with the first destination address in the form of entry groups. In the event of a changed target unicast entry, the second destination address can be quickly located. The second destination address is located in the network segment corresponding to the target address, or the target address is located in the network segment corresponding to the second destination address. The validity of flow specification entries with the second destination address as the destination address may be affected by the target unicast entry. Unicast routing entries related to flow specification entries with the second destination address are all in the first and second entry groups corresponding to the second destination address. Therefore, it is only necessary to use the first and second entry groups corresponding to the second destination address to detect the entries in the third entry group. Thus, when unicast routing entries change, the scheme provided by this application only requires detecting a portion of the flow specification entries based on a portion of the unicast routing entries, which can greatly reduce the number of entries that need to be processed during detection and improve detection efficiency.

[0278] In one embodiment of this application, if the second destination address is located in the network segment corresponding to the target address, the first entry detection module 703 is specifically used for:

[0279] For each second destination address, update the first entry group corresponding to that second destination address based on the target unicast entry;

[0280] When the first optimal entry in the first entry group is updated, the first flow specification entry corresponding to the first optimal entry is determined to be invalid. The first flow specification entry contains the second destination address and is different from the source node of the first optimal entry. The source node is another network device that initiates entry synchronization to the network device. The first optimal entry is: an entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0281] If any one of the first autonomous domains is different from the second autonomous domain, then the second flow specification entry is determined to be invalid. The second flow specification entry is: other flow specification entries in the third entry group corresponding to the second destination address, excluding the first flow specification entry. The first autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous domain is the autonomous domain where the network device is located. The second autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of the first optimal entry corresponding to the second destination address.

[0282] As can be seen from the above, in this embodiment, the validity of the flow specification entry in the third entry group corresponding to the second destination address is re-checked only when the first optimal entry corresponding to the first entry group is updated. Otherwise, the validity check is not performed, which can further save the number of validity checks and further save computing resources.

[0283] In one embodiment of this application, in the first entry group corresponding to each first destination address, based on the longest mask matching principle, unicast routing entries are arranged in descending order of matching degree with the first destination address. The following module determines whether the first optimal entry in the first entry group has been updated:

[0284] The entry change determination module is used to determine if the first optimal entry in the first entry group has been updated if the unicast routing entry that is first in the order of the first entry group has been updated.

[0285] As can be seen from the above, if the first entry group is constructed using this embodiment, it is possible to determine whether the first optimal entry has been updated simply by directly judging whether the unicast routing entry at the top and bottom of the first entry group has been updated. The determination method is relatively simple and does not require traversing the first entry group to find the first optimal entry.

[0286] In one embodiment of this application, if the target address is different from the second destination address, and the target address is located in the network segment corresponding to the second destination address, the first entry detection module 703 is specifically used for:

[0287] For each second destination address, update the second entry group corresponding to that second destination address based on the target unicast entry;

[0288] If any one of the third autonomous domains is different from the fourth autonomous domain, then the third flow specification entry is determined to be invalid;

[0289] The third flow specification entry is the flow specification entry in the third entry group corresponding to the second destination address. The third autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous system is the autonomous system where the network device is located. The fourth autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of the first optimal entry corresponding to the second destination address. The first optimal entry is the entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

[0290] As can be seen from the above, when detecting flow specification entries using this embodiment, if the second entry group corresponding to the second destination address is updated, it is only necessary to compare the third autonomous region and the fourth autonomous region based on the first and second entry groups to determine whether the invalid state of the flow specification entry in the third entry corresponding to the second destination address needs to be updated. This process involves only the comparison of a small number of unicast routing entries in the first and second entry groups, and may not even involve the comparison of flow specification entries in the third entry group. Therefore, the computational resources consumed are relatively small.

[0291] In one embodiment of this application, within the second entry group corresponding to each first destination address, the unicast routing entries are arranged in ascending or descending order of the value of the highest-order identifier in the Autonomous System Path (ASPATH), wherein the ASPATH contains the identifiers of the autonomous systems traversed during entry synchronization.

[0292] The following modules are used to determine whether any one of the third autonomous domains is different from the fourth autonomous domain:

[0293] The autonomous region determination module is used to determine that each third autonomous region is the same as the fourth autonomous region if the first autonomous region identifier and the second autonomous region identifier are the same as the third autonomous region identifier.

[0294] Wherein, the first autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is first in the order of the second table entry group corresponding to the second destination address;

[0295] The second autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is last in the order of the second entry group corresponding to the second destination address;

[0296] The third autonomous domain identifier is the identifier of the highest bit in ASPATH within the first optimal entry corresponding to the second destination address.

[0297] As can be seen from the above, when constructing the second entry group using this embodiment, it is only necessary to compare the three autonomous domain identifiers when checking the validity of the flow specification entries in the third entry group. It is not necessary to traverse the entire second entry group and sequentially determine whether the third autonomous domain of all unicast routing entries in the second entry group is the same as the fourth autonomous domain, which can save more computation.

[0298] In one embodiment of this application, the apparatus further includes:

[0299] The entry addition module is used to add the new flow specification entry to the third entry group corresponding to the third destination address if there are a first entry group, a second entry group, and a third entry group corresponding to the third destination address of the new flow specification entry.

[0300] The entry group construction module is used to determine that the new flow specification entry is invalid if the source node of the new flow specification entry is different from that of the first optimal entry corresponding to the third destination address, or if any one of the fifth autonomous domains is different from the sixth autonomous domain.

[0301] Wherein, the first optimal entry corresponding to the third destination address is: an entry that matches the third destination address, determined from the first entry group corresponding to the third destination address according to the longest mask matching principle; the source node is another network device that initiates entry synchronization to the network device; the fifth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing each second unicast routing entry corresponding to the third destination address; the current autonomous region is the autonomous region where the network device is located; and the sixth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing the first optimal entry corresponding to the third destination address.

[0302] As can be seen from the above, this embodiment can insert the new flow specification entry into the existing third entry group, or construct new first, second, and third entry groups for the new flow specification entry, when a new flow specification entry exists, thereby detecting whether the new flow specification entry is valid. This process only needs to use the new flow specification entry and the unicast routing entries in the first and second entry groups corresponding to its third destination address, without traversing the unicast routing entries for detection. Therefore, it can also save computing resources when re-checking the validity of the new flow specification entry.

[0303] In one embodiment of this application, the apparatus further includes:

[0304] The flow specification entry determination module is used to determine the target flow specification entry, wherein the field in the target flow specification entry indicating that the source node has been updated, and the source node is another network device that initiates entry synchronization to the network device;

[0305] The third entry detection module is used to determine that the target flow specification entry is invalid if the first optimal entry corresponding to the fourth destination address of the target flow specification entry is different from the source node of the target flow specification entry, or if any one of the seventh autonomous domains is different from the eighth autonomous domain.

[0306] Wherein, the first optimal entry corresponding to the fourth destination address is: the entry that matches the fourth destination address, determined from the first entry group corresponding to the fourth destination address according to the longest mask matching principle; the seventh autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of each second unicast routing entry corresponding to the fourth destination address; the current autonomous region is the autonomous region where the network device is located; and the eighth autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of the first optimal entry corresponding to the fourth destination address.

[0307] As can be seen from the above, this embodiment can re-detect the validity of a target flow specification entry even when such an entry exists. This process only requires using the target flow specification entry and the unicast routing entries in the first and second entry groups corresponding to its fourth destination address, without traversing all unicast routing entries. Therefore, it can also save computational resources when re-detecting the validity of the target flow specification entry.

[0308] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of any of the detection methods described above.

[0309] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to perform any of the detection methods described above.

[0310] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0311] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0312] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for network devices, apparatuses, computer-readable storage media, and computer program products are basically similar to the method embodiments, and therefore the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0313] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A detection method, characterized in that, Applied to network devices, the network devices store a first entry group, a second entry group, and a third entry group corresponding to each first destination address; The first entry group includes: a first unicast routing entry, wherein the first destination address is located in the network segment corresponding to the destination address in the first unicast routing entry; The second entry group includes: a second unicast routing entry, wherein the destination address in the second unicast routing entry is located in the network segment corresponding to the first destination address, and the destination address of the second unicast routing entry is different from the first destination address; The third entry group includes: a flow specification entry whose destination address is the first destination address; The method includes: Identify the target unicast entry that has changed, wherein the target unicast entry includes the target address, and the target unicast entry is a newly added unicast routing entry, or a unicast routing entry removed from the routing table, or a unicast routing entry whose contained information has been updated. Based on the target address, at least one second destination address is obtained from a plurality of first destination addresses, wherein the second destination address is located in the network segment corresponding to the target address, or, if the target address is different from the second destination address, the target address is located in the network segment corresponding to the second destination address; For each second destination address, based on the first and second entry groups corresponding to the second destination address, check whether the flow specification entry in the third entry group corresponding to the second destination address is invalid.

2. The method according to claim 1, characterized in that, If the second destination address is located in the network segment corresponding to the destination address, the step of detecting whether the flow specification entry in the third entry group corresponding to the second destination address is invalid based on the first and second entry groups corresponding to the second destination address includes: Update the first entry group corresponding to the second destination address based on the target unicast entry; When the first optimal entry in the first entry group is updated, the first flow specification entry corresponding to the first optimal entry is determined to be invalid. The first flow specification entry includes the second destination address and is different from the source node of the first optimal entry. The source node is another network device that initiates entry synchronization to the network device. The first optimal entry is: an entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle. If any one of the first autonomous domains is different from the second autonomous domain, then the second flow specification entry is determined to be invalid. The second flow specification entry is: other flow specification entries in the third entry group corresponding to the second destination address, excluding the first flow specification entry. The first autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through when synchronizing each second unicast routing entry corresponding to the second destination address. The current autonomous domain is the autonomous domain where the network device is located. The second autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through when synchronizing the first optimal entry corresponding to the second destination address.

3. The method according to claim 2, characterized in that, In the first entry group corresponding to each first destination address, based on the longest mask matching principle, unicast routing entries are arranged in descending order of matching degree with the first destination address. The first optimal entry in the first entry group is determined as follows: If the unicast routing entry that is first in the order of the first entry group is updated, then the first optimal entry in the first entry group is determined to have been updated.

4. The method according to claim 1, characterized in that, If the destination address is different from the second destination address, and the destination address is located in the network segment corresponding to the second destination address, the step of detecting whether the flow specification entry in the third entry group corresponding to the second destination address is invalid based on the first and second entry groups corresponding to the second destination address includes: Update the second entry group corresponding to the second destination address based on the target unicast entry; If any one of the third autonomous domains is different from the fourth autonomous domain, then the third flow specification entry is determined to be invalid; The third flow specification entry is the flow specification entry in the third entry group corresponding to the second destination address. The third autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous system is the autonomous system where the network device is located. The fourth autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of the first optimal entry corresponding to the second destination address. The first optimal entry is the entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

5. The method according to claim 4, characterized in that, Within the second entry group corresponding to each first destination address, the unicast routing entries are arranged in ascending or descending order of the value of the highest-order identifier in the Autonomous System Path (ASPATH), where ASPATH contains the identifiers of the autonomous systems traversed during entry synchronization. Determine whether any one in each third autonomous region is different from the fourth autonomous region in the following way: If the identifiers of the first autonomous region and the second autonomous region are the same as the identifier of the third autonomous region, then each third autonomous region is determined to be the same as the fourth autonomous region. Wherein, the first autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is first in the order of the second table entry group corresponding to the second destination address; The second autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is last in the order of the second entry group corresponding to the second destination address; The third autonomous domain identifier is the identifier of the highest bit in ASPATH within the first optimal entry corresponding to the second destination address.

6. The method according to any one of claims 1-5, characterized in that, The method further includes: If there are a first entry group, a second entry group, and a third entry group corresponding to the third destination address of the newly added flow specification entry, then the newly added flow specification entry is added to the third entry group corresponding to the third destination address. If the first entry group, the second entry group, and the third entry group corresponding to the third destination address do not exist, then the first entry group, the second entry group, and the third entry group corresponding to the third destination address are created. If the source node of the newly added flow specification entry is different from that of the first optimal entry corresponding to the third destination address, or if any one of the fifth autonomous domains is different from the sixth autonomous domain, then the newly added flow specification entry is determined to be invalid. Wherein, the first optimal entry corresponding to the third destination address is: an entry that matches the third destination address, determined from the first entry group corresponding to the third destination address according to the longest mask matching principle; the source node is another network device that initiates entry synchronization to the network device; the fifth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing each second unicast routing entry corresponding to the third destination address; the current autonomous region is the autonomous region where the network device is located; and the sixth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing the first optimal entry corresponding to the third destination address.

7. The method according to any one of claims 1-5, characterized in that, The method further includes: Determine the target flow specification entry, wherein the field in the target flow specification entry indicating that the source node has been updated, and the source node is another network device that initiates entry synchronization to the network device; If the first optimal entry corresponding to the fourth destination address of the target flow specification entry is different from the source node of the target flow specification entry, or if any one of the seventh autonomous domains is different from the eighth autonomous domain, then the target flow specification entry is determined to be invalid. Wherein, the first optimal entry corresponding to the fourth destination address is: the entry that matches the fourth destination address, determined from the first entry group corresponding to the fourth destination address according to the longest mask matching principle; the seventh autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of each second unicast routing entry corresponding to the fourth destination address; the current autonomous region is the autonomous region where the network device is located; and the eighth autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of the first optimal entry corresponding to the fourth destination address.

8. A detection device, characterized in that, Applied to network devices, the network devices store a first entry group, a second entry group, and a third entry group corresponding to each first destination address; The first entry group includes: a first unicast routing entry, wherein the first destination address is located in the network segment corresponding to the destination address in the first unicast routing entry; The second entry group includes: a second unicast routing entry, wherein the destination address in the second unicast routing entry is located in the network segment corresponding to the first destination address, and the destination address of the second unicast routing entry is different from the first destination address; The third entry group includes: a flow specification entry whose destination address is the first destination address; The device includes: The unicast entry determination module is used to determine the target unicast entry that has changed. The destination address in the target unicast entry is the target address. The target unicast entry is a newly added unicast routing entry, or a unicast routing entry removed from the routing table, or a unicast routing entry whose information has been updated. The second address determination module is used to obtain at least one second destination address from a plurality of first destination addresses based on the target address, wherein the second destination address is located in the network segment corresponding to the target address, or, if the target address is different from the second destination address, the target address is located in the network segment corresponding to the second destination address; The first entry detection module is used to detect, for each second destination address, whether the flow specification entry in the third entry group corresponding to the second destination address is invalid, based on the first entry group and the second entry group corresponding to the second destination address.

9. The apparatus according to claim 8, characterized in that, If the second destination address is located in the network segment corresponding to the target address, the first entry detection module is specifically used for: For each second destination address, update the first entry group corresponding to that second destination address based on the target unicast entry; When the first optimal entry in the first entry group is updated, the first flow specification entry corresponding to the first optimal entry is determined to be invalid. The first flow specification entry contains the second destination address and is different from the source node of the first optimal entry. The source node is another network device that initiates entry synchronization to the network device. The first optimal entry is: an entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle. If any one of the first autonomous domains is different from the second autonomous domain, then the second flow specification entry is determined to be invalid. The second flow specification entry is: other flow specification entries in the third entry group corresponding to the second destination address, excluding the first flow specification entry. The first autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous domain is the autonomous domain where the network device is located. The second autonomous domain is: the last autonomous domain different from the current autonomous domain that is passed through during the synchronization of the first optimal entry corresponding to the second destination address.

10. The apparatus according to claim 9, characterized in that, In the first entry group corresponding to each first destination address, based on the longest mask matching principle, unicast routing entries are arranged in descending order of matching degree with the first destination address. The following module determines whether the first optimal entry in the first entry group has been updated: The entry change determination module is used to determine if the first optimal entry in the first entry group has been updated if the unicast routing entry that is first in the order of the first entry group has been updated.

11. The apparatus according to claim 8, characterized in that, If the target address is different from the second destination address, and the target address is located in the network segment corresponding to the second destination address, the first entry detection module is specifically used for: For each second destination address, update the second entry group corresponding to that second destination address based on the target unicast entry; If any one of the third autonomous domains is different from the fourth autonomous domain, then the third flow specification entry is determined to be invalid; The third flow specification entry is the flow specification entry in the third entry group corresponding to the second destination address. The third autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of each second unicast routing entry corresponding to the second destination address. The current autonomous system is the autonomous system where the network device is located. The fourth autonomous system is the last autonomous system that is different from the current autonomous system that is passed through during the synchronization of the first optimal entry corresponding to the second destination address. The first optimal entry is the entry that matches the second destination address, determined from the first entry group corresponding to the second destination address according to the longest mask matching principle.

12. The apparatus according to claim 11, characterized in that, Within the second entry group corresponding to each first destination address, the unicast routing entries are arranged in ascending or descending order of the value of the highest-order identifier in the Autonomous System Path (ASPATH), where ASPATH contains the identifiers of the autonomous systems traversed during entry synchronization. The following modules are used to determine whether any one of the third autonomous domains is different from the fourth autonomous domain: The autonomous region determination module is used to determine that each third autonomous region is the same as the fourth autonomous region if the first autonomous region identifier and the second autonomous region identifier are the same as the third autonomous region identifier. Wherein, the first autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is first in the order of the second table entry group corresponding to the second destination address; The second autonomous system identifier is: the highest-order identifier in the ASPATH of the unicast routing table entry that is last in the order of the second entry group corresponding to the second destination address; The third autonomous domain identifier is the identifier of the highest bit in ASPATH within the first optimal entry corresponding to the second destination address.

13. The apparatus according to any one of claims 8-12, characterized in that, The device further includes: The entry addition module is used to add the new flow specification entry to the third entry group corresponding to the third destination address if there are a first entry group, a second entry group, and a third entry group corresponding to the third destination address of the new flow specification entry. The table entry group construction module is used to create the first table entry group, the second table entry group, and the third table entry group corresponding to the third destination address if the first table entry group, the second table entry group, and the third table entry group corresponding to the third destination address do not exist. The second entry detection module is used to determine that the new flow specification entry is invalid if the source node of the new flow specification entry is different from that of the first optimal entry corresponding to the third destination address, or if any one of the fifth autonomous domains is different from the sixth autonomous domain. Wherein, the first optimal entry corresponding to the third destination address is: an entry that matches the third destination address, determined from the first entry group corresponding to the third destination address according to the longest mask matching principle; the source node is another network device that initiates entry synchronization to the network device; the fifth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing each second unicast routing entry corresponding to the third destination address; the current autonomous region is the autonomous region where the network device is located; and the sixth autonomous region is: the last autonomous region different from the current autonomous region that is passed through when synchronizing the first optimal entry corresponding to the third destination address.

14. The apparatus according to any one of claims 8-12, characterized in that, The device further includes: The flow specification entry determination module is used to determine the target flow specification entry, wherein the field in the target flow specification entry indicating that the source node has been updated, and the source node is another network device that initiates entry synchronization to the network device; The third entry detection module is used to determine that the target flow specification entry is invalid if the first optimal entry corresponding to the fourth destination address of the target flow specification entry is different from the source node of the target flow specification entry, or if any one of the seventh autonomous domains is different from the eighth autonomous domain. Wherein, the first optimal entry corresponding to the fourth destination address is: the entry that matches the fourth destination address, determined from the first entry group corresponding to the fourth destination address according to the longest mask matching principle; the seventh autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of each second unicast routing entry corresponding to the fourth destination address; the current autonomous region is the autonomous region where the network device is located; and the eighth autonomous region is: the last autonomous region different from the current autonomous region that is passed through during the synchronization of the first optimal entry corresponding to the fourth destination address.

Images