Access switch-based hierarchical ARP proxy processing method, device, equipment, medium and product

Abstract

This application discloses a hierarchical ARP proxy processing method, apparatus, device, medium, and product based on access switches, relating to the field of computer technology. The method includes: pre-configuring static Address Resolution Protocol (ARP) proxy entries locally; receiving ARP request packets from access terminals and parsing the ARP request packets to obtain the source Media Access Control (MAC) address, target Internet Protocol (IP) address, VLAN information, and ingress port information; matching the target IP address, VLAN information, and ingress port information with the static ARP proxy entries; if a match is successful, constructing an ARP reply packet based on the static ARP proxy entries and unicasting it to the access terminal, without forwarding the ARP request packet to the core layer switch; if a match fails, forwarding the ARP request packet to the core layer switch or flooding it within the local broadcast domain. This method can reduce the ARP processing pressure on core devices from the access side.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a hierarchical ARP proxy processing method, apparatus, device, medium and product based on an access switch. Background Technology

[0002] With the rapid development of cloud computing, data centers, and campus networks, large Layer 2 networks are widely deployed. These networks typically employ a layered architecture of access switches plus aggregation / core switches. Terminals access the network through access switches, while gateways are deployed on Layer 3 devices such as core switches. In traditional solutions, when a terminal initiates an Address Resolution Protocol (ARP) request, the access switch only performs Layer 2 forwarding or flooding, transparently forwarding the ARP request to the core switch, which then performs ARP resolution and returns a response. ARP proxy functionality is also mostly concentrated on the core Layer 3 devices. Currently, these solutions cannot alleviate the ARP processing pressure on the core devices from the access side. Summary of the Invention

[0003] This application provides a hierarchical ARP proxy processing method, apparatus, device, medium, and product based on access switches, which can reduce the ARP processing pressure on core devices from the access side.

[0004] To achieve the above objectives, this application adopts the following technical solution: Firstly, this application provides a hierarchical ARP proxy processing method based on an access switch, including: Pre-configure static Address Resolution Protocol (ARP) proxy entries locally; Receive ARP request packets from access terminals and parse the ARP request packets to obtain the source Media Access Control MAC address, target Internet Protocol IP address, VLAN information, and ingress port information; Match the target IP address, VLAN information, and ingress port information with the static ARP proxy entries; If a match is successful, an ARP response packet is constructed based on the static ARP proxy entry and unicasted to the access terminal, and the ARP request packet is no longer forwarded to the core layer switch; If a match fails, the ARP request message will be forwarded to the core layer switch or flooded within the broadcast domain.

[0005] In some possible implementations, if a match is successful, before constructing the ARP reply packet based on the static ARP proxy entry, the following steps are included: Calculate the isolation parameter based on the ingress port information and the egress port information associated with the target IP address; If the isolation parameter is greater than the preset isolation threshold, it is determined that the access terminal and the target device corresponding to the target IP address are in different isolation domains, and the ARP request packet is forwarded to the core layer switch for processing. If the isolation parameter is less than or equal to the preset isolation threshold, an ARP response message is constructed based on the static ARP proxy entry.

[0006] Among the possible implementations are: For each ARP request packet forwarded to the core layer switch, a corresponding pending response record is created locally for that ARP request packet, and a response waiting timer is started. If an ARP reply message is received for the ARP request message before the reply waiting timer expires, the corresponding pending reply record is deleted. If no ARP response message is received for the ARP request message after the response waiting timer expires, an error is determined to have occurred and error handling operations are performed.

[0007] Among the possible implementations are: Frequency control is applied to ARP requests initiated by the same access terminal based on the source MAC address. If the request exceeds a preset threshold within a preset time window, subsequent duplicate ARP requests will be blocked.

[0008] In some possible implementations, ARP response messages are constructed based on static ARP proxy entries, including: Use the target IP address as the requested Internet Protocol address, use the proxy MAC address in the static ARP proxy entry as the requested MAC address, and use the gateway information or virtual gateway MAC address consistent with the core layer switch.

[0009] Among the possible implementations are: The source MAC address, destination IP address, VLAN information, and ingress port information obtained from the parsing are validated. If the validation passes, the matching continues; otherwise, the ARP request packet is discarded.

[0010] Secondly, this application provides a hierarchical ARP proxy processing device based on an access switch, comprising: The configuration module is used to pre-configure static Address Resolution Protocol (ARP) proxy entries locally; The parsing module is used to receive ARP request packets from the access terminal and parse the ARP request packets to obtain the source Media Access Control MAC address, the target Internet Protocol IP address, VLAN information, and ingress port information. The matching module is used to match the target IP address, VLAN information, and ingress port information with the static ARP proxy entry. If the match is successful, an ARP reply packet is constructed based on the static ARP proxy entry and unicasted to the access terminal. The ARP request packet is no longer forwarded to the core layer switch. If the match fails, the ARP request packet is forwarded to the core layer switch or flooded within the broadcast domain.

[0011] Thirdly, this application provides a computing device, including a memory and a processor; The memory stores one or more computer programs, the one or more computer programs including instructions; when the instructions are executed by the processor, the computing device performs the method as described in any one of the first aspects.

[0012] Fourthly, this application provides a computer-readable storage medium for storing a computer program for performing the method as described in any one of the first aspects.

[0013] Fifthly, this application provides a computer program product comprising one or more computer instructions, wherein when the computer instructions are executed by a computer, the computer performs the method as described in any one of the first aspects.

[0014] As can be seen from the above technical solution, this application has at least the following beneficial effects: In this application, by pre-configuring static ARP proxy entries locally on the access switch, the access switch receives and parses ARP request packets sent by access terminals to obtain the source MAC address, destination IP address, VLAN information, and ingress port information. This information is then matched against the static ARP proxy entries. If a match is successful, the access switch constructs an ARP response packet based on the static ARP proxy entry and sends it to the corresponding access terminal via unicast, without forwarding the ARP request packet to the core layer switch. If a match fails, the access switch forwards the ARP request packet to the core layer switch or floods it within the local broadcast domain. This application decentralizes the ARP request judgment and response processing logic to the access switch. By establishing local matching rules through pre-configured static ARP proxy entries, the access switch gains the ability to independently identify and respond to ARP requests, changing the traditional model where ARP requests are handled solely by the core layer switch. The access switch processes ARP requests based on the local matching results, completing closed-loop processing at the access layer for successfully matched ARP requests, and only uploading unmatched ARP requests according to the original process, thus achieving hierarchical handling of ARP traffic.

[0015] By directly responding to successfully matched ARP requests locally at the access switch, the number of ARP requests uploaded to the core layer switch can be significantly reduced. This effectively alleviates the problem of excessive CPU and control plane load on the core layer switch caused by handling a large number of ARP requests, thus reducing the operating pressure on core devices. Simultaneously, this solution deploys the parsing, matching, and response logic at the access switch, fully utilizing the local computing and storage resources of the access switch and improving the situation where access switches only forward packets and have low resource utilization in the traditional approach. Furthermore, by completing ARP responses at the access layer and using unicast replies, ARP broadcast flooding traffic in the network can be reduced, avoiding network congestion and performance degradation caused by a large number of broadcast packets in large Layer 2 networks. This improves the overall network operational stability and forwarding efficiency, ultimately reducing the ARP processing pressure on core devices from the access side.

[0016] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0017] Figure 1 An application environment diagram for a hierarchical ARP proxy processing method based on an access switch provided in this application embodiment; Figure 2 A flowchart illustrating a hierarchical ARP proxy processing method based on an access switch, provided in an embodiment of this application; Figure 3 A structural diagram of a hierarchical ARP proxy processing device based on an access switch provided in this application embodiment; Figure 4 This is a schematic diagram of a computing device provided in an embodiment of this application. Detailed Implementation

[0018] The terms "first," "second," and "third," etc., used in this application specification and accompanying drawings are used to distinguish different objects, not to limit a specific order.

[0019] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0020] To ensure clarity and conciseness in the description of the following embodiments, a brief introduction to the related technologies is given first: Address Resolution Protocol (ARP) is used within a local area network (LAN) to resolve network layer IP addresses to data link layer MAC addresses, and is a fundamental protocol for terminal access to the network. Large Layer 2 networks widely adopt a layered architecture of access switches + core switches, with gateways centrally deployed at the core layer to handle ARP requests across the entire network. ARP proxies are typically configured on core Layer 3 devices for cross-segment address resolution responses.

[0021] As the number of access terminals increases, a large number of ARP broadcast requests will be sent to the core layer through the access switch, resulting in excessive load on the core device's CPU and control plane. The local computing and storage resources of the access switch are not effectively utilized, and there is too much ARP broadcast traffic in the network, which in turn affects the network forwarding performance and stability.

[0022] In view of this, embodiments of this application provide a hierarchical ARP proxy processing method based on access switches. To make the technical solution of this application clearer and easier to understand, the application scenarios of the technical solution of this application are described below with reference to the accompanying drawings. Figure 1 As shown, this figure is an application environment diagram provided by an embodiment of this application.

[0023] In this application environment, the access switch is the main executor. The interaction process between the access switch, the access terminal, and the core layer switch is as follows: The access terminal sends an ARP request message to the access switch. The access switch receives and parses the message, and matches the target IP, VLAN, and ingress port information with the local static ARP proxy entry. If the match is successful, the access switch directly constructs an ARP reply message and unicasts it back to the access terminal without forwarding it to the core layer switch. If the match fails, the ARP request message is forwarded to the core layer switch for processing.

[0024] To make the technical solution of this application clearer and easier to understand, the following describes a hierarchical ARP proxy processing method based on an access switch, using the above application scenario as the execution subject. For example... Figure 2As shown in the figure, this is a flowchart illustrating a hierarchical ARP proxy processing method based on an access switch provided in an embodiment of this application. The hierarchical ARP proxy processing method based on an access switch includes: S201. Pre-configure static address resolution protocol ARP proxy entries locally.

[0025] Static Address Resolution Protocol (ARP) proxy entries are address mapping records stored locally on the access switch. They include the proxy's effective scope, which can include at least one of the following: Virtual Local Area Network (VLAN) range, access port range, and IP address range. The proxy's effective scope is the limited interval within which the static ARP proxy entry takes effect. The VLAN range is the set of network identifiers that restricts the proxy behavior.

[0026] It should be noted that static ARP proxy entries support batch configuration and automatic activation. Access switches can load the latest proxy configuration without restarting after an entry is updated. The target IP address proxied by a static ARP proxy entry is either the gateway IP address or the service server IP address.

[0027] For example, the access switch receives configuration instructions from the management interface or management channel. The access switch enters static ARP proxy entries according to the configuration instructions. The access switch writes the proxy scope into the static ARP proxy entries. The access switch stores at least one of the following information into the proxy scope: VLAN range, access port range, and IP address range. The access switch performs a batch configuration operation on multiple entered static ARP proxy entries. The access switch enables the static ARP proxy entries after the batch configuration operation is completed. When updating static ARP proxy entries, the access switch directly reads and enables the updated content. The access switch can complete the loading of the latest proxy configuration without performing a restart operation. The access switch stores the loaded static ARP proxy entries in its local storage area.

[0028] S202. Receive an ARP request message from the access terminal and parse the ARP request message to obtain the source Media Access Control MAC address, the target Internet Protocol IP address, VLAN information, and ingress port information.

[0029] Optionally, the source MAC address, target IP address, VLAN information, and ingress port information obtained from the parsing can be validated. If the validation passes, the matching continues; otherwise, the ARP request packet is discarded.

[0030] In this context, an access terminal is a terminal device that connects to the network through an access switch port. VLAN information identifies the virtual local area network to which a packet belongs. Ingress port information identifies the physical port on the access switch through which a packet enters. The gateway IP address is the device address used for network segment forwarding. The service server IP address is the device address providing service functions within the network.

[0031] For example, an access switch receives ARP request packets from access terminals via its downstream ports. The access switch performs parsing on the received ARP request packets, extracting the source Media Access Control (MAC) address, destination Internet Protocol (IP) address, VLAN information, and ingress port information from the packet header and payload. The access switch stores the parsed source MAC address, destination IP address, VLAN information, and ingress port information in a local temporary cache. The access switch performs validity checks on the above information, checking whether the address format conforms to the specifications, whether the values ​​are within the allowed range, and whether there is a correspondence between the VLAN information and the ingress port information. If the validity check passes, the access switch uses the above information for matching static ARP proxy entries. If the validity check fails, the access switch discards the ARP request packet and does not perform any further processing.

[0032] S203. Match the target IP address, VLAN information, and ingress port information with the static ARP proxy entry. If the match is successful, construct an ARP reply packet based on the static ARP proxy entry and unicast it to the access terminal. Do not forward the ARP request packet to the core layer switch. If the match fails, forward the ARP request packet to the core layer switch or flood it within the broadcast domain.

[0033] One possible approach is to use the target IP address as the requested Internet Protocol address, the proxy MAC address in the static ARP proxy entry as the requested MAC address, and to use gateway information or virtual gateway MAC addresses consistent with those of the core layer switch.

[0034] Optionally, frequency control can be applied to ARP requests initiated by the same access terminal based on the source MAC address. If the request exceeds a preset threshold within a preset time window, subsequent duplicate ARP requests will be blocked.

[0035] The requested Internet Protocol address is the network address queried in the ARP reply. The requested MAC address is the physical address queried in the ARP reply. Gateway information is configuration information related to network segment forwarding. The virtual gateway MAC address is a virtual physical address used to replace physical devices. The preset time window is a pre-defined statistical time interval. The preset request threshold is a pre-defined maximum number of allowed requests.

[0036] For example, the access switch compares the resolved target IP address, VLAN information, and ingress port information with the locally stored static ARP proxy entries. If the target IP address, VLAN information, and ingress port information all match the static ARP proxy entries, the access switch determines a successful match. After a successful match, the access switch constructs an ARP reply packet according to the network protocol format, using the target IP address as the requested party's Internet Protocol address and the proxy MAC address from the static ARP proxy entry as the requested party's MAC address. During construction, it uses the same gateway information or virtual gateway MAC address as the core layer switch. The access switch sends the constructed ARP reply packet to the access terminal that sent the ARP request via unicast, without forwarding the corresponding ARP request packet to the core layer switch. If any of the target IP address, VLAN information, or ingress port information does not match the static ARP proxy entries, the access switch determines a failed match. After a failed match, the access switch forwards the ARP request packet to the core layer switch or floods it within the local broadcast domain to all ports except the ingress port. The access switch uses the source MAC address as an identifier to count the number of ARP requests initiated by the same access terminal within a preset time window. When the count exceeds a preset request threshold, the access switch blocks subsequent duplicate ARP requests sent by that access terminal.

[0037] Before constructing the ARP reply message based on the static ARP proxy entry, the following is included: Based on the ingress port information and the egress port information associated with the target IP address, the isolation parameter is calculated. If the isolation parameter is greater than the preset isolation threshold, it is determined that the access terminal and the target device corresponding to the target IP address are in different isolation domains, and the ARP request packet is forwarded to the core layer switch for processing. If the isolation parameter is less than or equal to the preset isolation threshold, an ARP reply packet is constructed based on the static ARP proxy entry.

[0038] Isolation parameter is a quantitative indicator that measures the degree of isolation between the port where the access terminal is located and the port where the target device is located. It can be determined based on at least one factor: whether the ingress port and egress port belong to the same virtual LAN VLAN, whether the ingress port and egress port are configured with port isolation or private VLAN attributes, whether the access control list (ACL) rules between the ingress port and egress port allow Layer 2 communication, and whether the ingress port and egress port belong to different fault domains or security domains.

[0039] The preset isolation threshold is used to determine whether two ports are in different isolation domains. This threshold can be set according to the network's security policy and isolation requirements. For example, it can be set to a higher value, triggering isolation judgment only when multiple isolation factors overlap; or it can be set to 1, indicating that the isolation level is exceeded as long as any isolation factor exists.

[0040] The access switch uses the target IP address as the key to query its local MAC address table or forwarding table to obtain the outgoing port information corresponding to that target IP address. The outgoing port information refers to the switch port connected to the device corresponding to the target IP address, determined by the access switch after searching its local MAC address table or forwarding table. For example, if the outgoing port information corresponding to the target IP address is not found in the local forwarding table, the access switch will flood the ARP request packet within its broadcast domain or forward it to the core layer switch for processing.

[0041] The access switch calculates isolation parameters based on ingress and egress port information, combined with locally configured VLAN information, port isolation attributes, and other factors. For example, it checks isolation factors item by item based on ingress and egress port information, scoring 1 point for each correct match.

[0042] Isolation Factor 1: The ingress port and egress port do not belong to the same VLAN, 1 point is awarded; Isolation Factor 2: Enable port isolation / Private VLAN on inbound and outbound ports, 1 point; Isolation Factor 3: The ACL (Access Control List) between the ingress and egress ports prevents Layer 2 communication, deducting 1 point; Isolation Factor 4: The ingress port and the egress port belong to different fault domains / safety domains, score 1 point.

[0043] The isolation parameter is obtained by summing the scores, i.e., the isolation parameter = the sum of the scores of each item (the smaller the isolation parameter, the more secure and proxied it is; the larger the isolation parameter, the stronger the isolation, and it should not be proxied locally).

[0044] The isolation parameter is compared with the isolation threshold. If the isolation parameter is greater than the isolation threshold, it is a cross-isolation domain, and the ARP request message is forwarded to the core layer switch without local proxy. If the isolation parameter is less than or equal to the isolation threshold, it is a same domain / interoperability is allowed, and local proxy response is performed. That is, the operation of constructing ARP response message based on static ARP proxy entry and sending it to the access terminal in unicast form.

[0045] Through this isolation level detection, the access switch can securely execute local ARP proxy responses without violating the original network isolation policy, thus preventing Layer 2 communication between ports that should be isolated from occurring due to excessive proxy functionality, thereby ensuring the network's security isolation requirements.

[0046] To ensure that terminals can still obtain ARP replies normally when the core layer switch malfunctions, the following operations are performed: For each ARP request packet forwarded to the core layer switch, a pending reply record corresponding to the ARP request packet is created locally, and a reply waiting timer is started; if an ARP reply packet for the ARP request packet is received before the reply waiting timer expires, the corresponding pending reply record is deleted; if no ARP reply packet for the ARP request packet is received after the reply waiting timer expires, a reply missing anomaly is determined to have occurred, and anomaly handling operations are performed.

[0047] Anomaly handling operations may include, but are not limited to, the access switch proactively constructing an ARP reply packet using the proxy MAC address in the static ARP proxy entry and sending it to the corresponding access terminal; if, within a preset time window, the cumulative number of missing reply events for the same target IP address exceeds a preset threshold, the access switch automatically adds the target IP address to the proxy scope of the static ARP proxy entry; if the access switch receives an ARP reply packet but cannot find the corresponding pending reply record locally, it determines that an illegal reply anomaly has occurred and adds the source MAC address of the ARP reply packet to the blacklist.

[0048] For example, when an access switch forwards an ARP request packet to a core switch, it simultaneously creates a pending response record in its local memory corresponding to that ARP request packet. This pending response record includes at least the packet's identification information (such as the packet sequence number or hash value), the target IP address, the source MAC address (i.e., the access terminal initiating the request), the ingress port information, the VLAN information, and a forwarding timestamp. A preset response waiting timer (which can be pre-configured according to the network environment) is also started concurrently. Before the timer expires, if the access switch receives an ARP response packet from the core switch that matches the record, it confirms the response process has been completed normally and directly deletes the local pending response record. If no corresponding ARP response is received after the timer expires, it is determined to be an abnormal response, such as insufficient processing capacity of the core switch (e.g., CPU overload), link failure, or the target device itself not existing. This triggers preset abnormal response operations to ensure uninterrupted network access for the terminal.

[0049] The anomaly handling procedures include: the access switch directly constructs a legitimate ARP reply packet using the proxy MAC address in its local static ARP proxy entry and actively unicasts the constructed legitimate ARP reply packet to the requesting access terminal to complete the response; simultaneously, the access switch counts the number of missing responses for the same target IP address. If the cumulative number of timeouts reaches a preset threshold within a specified time window, it indicates that the target IP address may be unable to respond normally for an extended period. The access switch automatically adds the target IP address to its local static ARP proxy entry, and any subsequent ARP request packets from this target IP address are directly answered by the access switch, no longer relying on the core layer response; the access switch also performs a validity check on the received ARP reply packets. If the received ARP reply packet has no matching pending response record locally, it is determined to be an illegal response anomaly. The access switch adds the source MAC address of the ARP reply packet to its blacklist and blocks all subsequent ARP packets sent by that source MAC address to prevent ARP spoofing and illegal response attacks.

[0050] Optionally, after a successful match and completion of the local ARP proxy response, the access switch stores the terminal source MAC address, target IP address, VLAN information, ingress port information, and request time corresponding to this proxy in the local proxy log table, forming an ARP proxy operation record. The access switch supports filtering, querying, and statistical analysis of the proxy log by VLAN, access port, and IP address range. Administrators can monitor the effectiveness of ARP proxies through the proxy logs, promptly identify abnormal ARP requests, and improve the observability and fault location efficiency of network operations and maintenance.

[0051] After forwarding the ARP request packet to the core layer switch, the access switch continues to operate in promiscuous snooping mode, capturing the ARP reply packet returned by the core layer switch. It parses this ARP reply packet, extracting key fields such as the target IP address, corresponding MAC address, VLAN information, and outgoing port information. Based on the parsing results, the access switch automatically generates a candidate static ARP proxy entry using "target IP address + VLAN information + outgoing port information" as the matching key. The proxy MAC address of the candidate entry is set to the parsed MAC address, and its effective scope is limited to the access ports corresponding to that VLAN and outgoing port. Furthermore, the access switch stores this candidate static ARP proxy entry in the pending activation area and initiates a dual verification mechanism combining silent verification and reverse probe verification. For example, silent verification includes, within a subsequent preset time window (e.g., 5 minutes), when the access switch receives a new ARP request with the same target IP address, it first attempts to use the candidate entry for local proxy reply. If no retry or error report is received from the terminal side after N consecutive replies (e.g., 3 times), the candidate entry is deemed correct. Reverse probe verification involves the access switch actively sending a non-destructive ARP probe request to the terminal recorded in the candidate entry, using the target IP address in the candidate entry as the source. If a response with the expected MAC address is received, the verification is successful.

[0052] After successful verification, the access switch moves the candidate static ARP proxy entry from the pending activation zone to the formal static ARP proxy entry table, marks it as "dynamic learning," and sets an aging timer (e.g., 24 hours). Simultaneously, the access switch sends a lightweight notification message to the core layer switch via the management channel, informing the core layer that the entry has been proxied by the access layer, and the core layer can accordingly reduce the priority of ARP request processing for that IP address.

[0053] If the access switch continuously matches and successfully responds to ARP requests for this entry within the aging timer's validity period, the aging timer is refreshed. If the timer expires without use, the entry is downgraded to a pending status. If it remains unused after another aging cycle, it is automatically deleted. Administrators can also convert dynamically learned entries to permanent static entries at any time via command line.

[0054] Based on a static ARP proxy entry self-learning and supplementation mechanism, access switches can not only execute statically configured ARP proxies but also actively learn high-frequency, stable address resolution relationships in the network and automatically generate proxy entries. The self-learned entries undergo silent verification and reverse probing for dual validation, ensuring the correctness and security of proxy responses and preventing network connectivity failures caused by erroneous proxies. This mechanism further enhances the effect of reducing ARP processing pressure on core devices from the access side.

[0055] Based on the above, this hierarchical ARP proxy processing method based on access switches pre-configures static ARP proxy entries locally on the access switch. The access switch receives and parses ARP request packets sent by access terminals to obtain the source MAC address, destination IP address, VLAN information, and ingress port information. This information is then matched against the static ARP proxy entries. If a match is successful, the access switch constructs an ARP response packet based on the static ARP proxy entry and sends it to the corresponding access terminal via unicast, without forwarding the ARP request packet to the core layer switch. If a match fails, the access switch forwards the ARP request packet to the core layer switch or floods it within its broadcast domain. This application decentralizes the ARP request judgment and response processing logic to the access switch. By establishing local matching rules through pre-setting static ARP proxy entries, the access switch gains the ability to independently identify and respond to ARP requests, changing the traditional mode where ARP requests are only processed by the core layer switch. The access switch processes ARP requests based on the local matching results, handling successfully matched ARP requests at the access layer and only uploading unmatched ARP requests according to the original process, thus achieving hierarchical handling of ARP traffic.

[0056] By directly responding to successfully matched ARP requests locally at the access switch, the number of ARP requests uploaded to the core layer switch can be significantly reduced. This effectively alleviates the problem of excessive CPU and control plane load on the core layer switch caused by handling a large number of ARP requests, thus reducing the operating pressure on core devices. Simultaneously, this solution deploys the parsing, matching, and response logic at the access switch, fully utilizing the local computing and storage resources of the access switch and improving the situation where access switches only forward packets and have low resource utilization in the traditional approach. Furthermore, by completing ARP responses at the access layer and using unicast replies, ARP broadcast flooding traffic in the network can be reduced, avoiding network congestion and performance degradation caused by a large number of broadcast packets in large Layer 2 networks. This improves the overall network operational stability and forwarding efficiency, ultimately reducing the ARP processing pressure on core devices from the access side.

[0057] The above text combined Figures 1 to 2 The hierarchical ARP proxy processing method based on access switches provided in the embodiments of this application has been described in detail. The apparatus and devices provided in the embodiments of this application will be described below with reference to the accompanying drawings.

[0058] This application also provides a hierarchical ARP proxy processing device based on an access switch, such as... Figure 3 As shown in the figure, this is a structural diagram of a hierarchical ARP proxy processing device based on an access switch provided in an embodiment of this application. The device includes: Configuration module 301 is used to pre-configure static address resolution protocol ARP proxy entries locally; The parsing module 302 is used to receive ARP request packets from the access terminal and parse the ARP request packets to obtain the source Media Access Control MAC address, the target Internet Protocol IP address, VLAN information and ingress port information; Matching module 303 is used to match the target IP address, VLAN information, and ingress port information with the static ARP proxy entry. If the match is successful, an ARP reply packet is constructed based on the static ARP proxy entry and unicasted to the access terminal, and the ARP request packet is no longer forwarded to the core layer switch. If the match fails, the ARP request packet is forwarded to the core layer switch or flooded within the broadcast domain.

[0059] In some possible implementations, the Static Address Resolution Protocol (ARP) proxy entry includes a proxy scope, which may include at least one of the following: Virtual Local Area Network (VLAN) range, Access Port range, and IP address range.

[0060] In some possible implementations, the matching module 303 is specifically used for: Based on the ingress port information and the egress port information associated with the target IP address, the isolation parameter is calculated. If the isolation parameter is greater than the preset isolation threshold, it is determined that the access terminal and the target device corresponding to the target IP address are in different isolation domains, and the ARP request packet is forwarded to the core layer switch for processing. If the isolation parameter is less than or equal to the preset isolation threshold, an ARP reply packet is constructed based on the static ARP proxy entry.

[0061] In some possible implementations, the hierarchical ARP proxy processing device based on the access switch also includes: The timing module is used to create a pending response record for each ARP request packet forwarded to the core layer switch locally and start a response waiting timer. If an ARP response packet for the ARP request packet is received before the response waiting timer expires, the corresponding pending response record is deleted. If no ARP response packet for the ARP request packet is received after the response waiting timer expires, a response missing anomaly is determined to have occurred, and an anomaly handling operation is performed.

[0062] In some possible implementations, the matching module 303 is specifically used for: Use the target IP address as the requested Internet Protocol address, use the proxy MAC address in the static ARP proxy entry as the requested MAC address, and use the gateway information or virtual gateway MAC address consistent with the core layer switch.

[0063] In some possible implementations, the hierarchical ARP proxy processing device based on the access switch also includes: The verification module is used to verify the validity of the parsed source MAC address, target IP address, VLAN information, and ingress port information. If the verification passes, the matching continues; otherwise, the ARP request packet is discarded.

[0064] The hierarchical ARP proxy processing device based on an access switch according to the embodiments of this application can correspondingly execute the method described in the embodiments of this application, and the other operations and / or functions of each module / unit of the hierarchical ARP proxy processing device based on an access switch are respectively for implementing Figure 2 For the sake of brevity, the corresponding processes of each method in the illustrated embodiments will not be described in detail here.

[0065] This application also provides a computing device. For example... Figure 4 As shown in the figure, this is a schematic diagram of a computing device provided in an embodiment of this application. The computing device 400 includes a bus 401, a processor 402, a communication interface 403, and a memory 404. The processor 402, the memory 404, and the communication interface 403 communicate with each other via the bus 401.

[0066] Bus 401 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 4 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0067] Processor 402 can be any one or more of the following processors: central processing unit (CPU), graphics processing unit (GPU), microprocessor (MP), or digital signal processor (DSP).

[0068] Communication interface 403 is used for communication with external devices.

[0069] Memory 404 may include volatile memory, such as random access memory (RAM). Memory 404 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0070] The memory 404 stores executable code, and the processor 402 executes the executable code to perform the aforementioned hierarchical ARP proxy processing method based on the access switch.

[0071] Specifically, in achieving Figure 3 In the case of the illustrated embodiment, and Figure 3 When the modules or units of the hierarchical ARP proxy processing device based on the access switch described in the embodiment are implemented in software, the execution... Figure 3 The software or program code required for the functions of each module / unit can be partially or wholly stored in memory 404. Processor 402 executes the program code corresponding to each unit stored in memory 404, and executes the aforementioned hierarchical ARP proxy processing method based on access switch.

[0072] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the aforementioned hierarchical ARP proxy processing method based on an access switch.

[0073] This application also provides a computer program product comprising one or more computer instructions. When the computer instructions are loaded and executed on a computing device, all or part of the processes or functions described in this application are generated.

[0074] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, fiber optic) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0075] When the computer program product is executed by a computer, the computer executes any of the aforementioned hierarchical ARP proxy processing methods based on access switches. The computer program product can be a software installation package; when any of the aforementioned hierarchical ARP proxy processing methods based on access switches is required, the computer program product can be downloaded and executed on the computer.

[0076] The descriptions of the processes or structures corresponding to the above figures each have their own emphasis. For parts of a process or structure that are not described in detail, please refer to the relevant descriptions of other processes or structures.

[0077] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application.

Claims

1. A hierarchical ARP proxy processing method based on an access switch, characterized in that, The method includes: Pre-configure static Address Resolution Protocol (ARP) proxy entries locally; Receive ARP request packets from access terminals and parse the ARP request packets to obtain the source Media Access Control MAC address, target Internet Protocol IP address, VLAN information, and ingress port information; Match the target IP address, VLAN information, and ingress port information with static ARP proxy entries; If a match is successful, an ARP response packet is constructed based on the static ARP proxy entry and unicasted to the access terminal, and the ARP request packet is no longer forwarded to the core layer switch; If a match fails, the ARP request message will be forwarded to the core layer switch or flooded within the broadcast domain.

2. The method according to claim 1, characterized in that, If a match is successful, before constructing an ARP response packet based on the static ARP proxy entry, the following steps are included: Based on the ingress port information and the egress port information associated with the target IP address, calculate the isolation parameter; If the isolation parameter is greater than the preset isolation threshold, it is determined that the access terminal and the target device corresponding to the target IP address are in different isolation domains, and the ARP request message is forwarded to the core layer switch for processing. If the isolation parameter is less than or equal to the preset isolation threshold, an ARP response message is constructed based on the static ARP proxy entry.

3. The method according to claim 1, characterized in that, The method further includes: For each ARP request packet forwarded to the core layer switch, a corresponding pending response record is created locally for that ARP request packet, and a response waiting timer is started. If an ARP reply message is received for the ARP request message before the reply waiting timer expires, the corresponding pending reply record is deleted. If no ARP response message is received for the ARP request message after the response waiting timer expires, a response missing exception is determined to have occurred, and exception handling operations are performed.

4. The method according to claim 1, characterized in that, The method further includes: Frequency control is applied to ARP requests initiated by the same access terminal based on the source MAC address. If the request exceeds a preset threshold within a preset time window, subsequent duplicate ARP requests will be blocked.

5. The method according to claim 1, characterized in that, The construction of the ARP response message based on the static ARP proxy entry includes: Use the target IP address as the requested Internet Protocol address, use the proxy MAC address in the static ARP proxy entry as the requested MAC address, and use the gateway information or virtual gateway MAC address consistent with the core layer switch.

6. The method according to claim 1, characterized in that, The method further includes: The source MAC address, target IP address, VLAN information, and ingress port information obtained from the parsing are validated. If the validation passes, the matching continues; otherwise, the ARP request packet is discarded.

7. A hierarchical ARP proxy processing device based on an access switch, characterized in that, The device includes: The configuration module is used to pre-configure static Address Resolution Protocol (ARP) proxy entries locally; The parsing module is used to receive ARP request packets from the access terminal and parse the ARP request packets to obtain the source Media Access Control MAC address, the target Internet Protocol IP address, VLAN information, and ingress port information. The matching module is used to match the target IP address, VLAN information, and ingress port information with the static ARP proxy entry. If the match is successful, an ARP reply packet is constructed based on the static ARP proxy entry and unicasted to the access terminal, and the ARP request packet is no longer forwarded to the core layer switch. If the match fails, the ARP request packet is forwarded to the core layer switch or flooded within the broadcast domain.

8. A computing device, characterized in that, Including memory and processor; The memory stores one or more computer programs, the one or more computer programs including instructions; when the instructions are executed by the processor, the computing device performs the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program for performing the method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes one or more computer instructions that, when executed by a computer, perform the method as described in any one of claims 1 to 6.

Images