55 results about "Reverse path forwarding" patented technology

Permitting a mobile host to roam in a foreign network, with multiple access node handoffs, while permitting foreign network multicasting by (i) having the mobile node (MN) use a persistent address, for purposes of multicasting, and (ii) relaxing or modifying reverse path forwarding checks, and (iii) modifying the forwarding of multicast packets sent from a non-local source address. The persistent address, used in mobile networks as the source address in the IGMP Membership reports and the multicast packets, may be the permanent and hence stable host home address (HoA). This enables the HoA to be supported as a source address by foreign agents (FAs) and multicast routing protocols in foreign networks.

A mechanism is provided in which multicast reverse path forwarding can be performed at a provider network egress edge router wherein core routers of the provider network are not configured to support multicast protocols or point-to-multipoint LSPs. An embodiment of the present invention provides for the creation of virtual interfaces in the egress edge router element during configuration of a multicast connection in response to a subscriber request. A virtual interface will be associated with an upstream ingress edge router element and that ingress edge router element is provided a label associated with the virtual interface. Such a label can then be included in datastream packets transmitted through the provider network. The label can then be used by reverse path forward checking at the egress edge router element to ascertain whether the multicast datastream is being received by the correct upstream interface (e.g., the virtual interface associated with the ingress edge router element). In such a manner, core network router elements of the provider's network need not be configured to process multicast transmissions as such, nor need the core router elements be configured to use the same network protocols as those used by the customer networks (e.g., customer networks can use IPv6 while the core network routers can use IPv4).

A Multicast Listener Discovery (MLD) protocol query and/or report snooping process is modified to appropriately map secondary PVLAN identifiers to corresponding primary PVLAN identifiers, thereby accommodating other system elements that are otherwise unaware of primary/secondary PVLAN distinctions. Special cases are also accommodated where reverse path forwarding (RPF) checks in support of multicast operation might otherwise fail due to primary/secondary PVLAN distinctions. Additional steps are taken to ensure that PVLAN information properly accounts for changes in configuration and/or location of various network hosts.

A link state advertisement protocol message received from an originating device over an inbound interface is forwarded over the fast path according to a reverse path forwarding determination. Specifically, a reverse path forwarding check is performed in order to determine the reverse path forwarding interface for the originating device. A forwarding state that indicates the reverse path forwarding interface may be installed, in which case the forwarding state may be used to determine the reverse path forwarding interface. If the inbound interface is determined to be the reverse path forwarding interface for the originating device, then the link state advertisement protocol message is forwarded over the fast path. Otherwise, the link state advertisement protocol message is not forwarded over the fast path. The link state advertisement protocol message continues to be processed and forwarded by the control plane as usual for robustness.

A method and apparatus for defending against denial of service (DoS) attacks which employ IP (Internet Protocol) address spoofing. In accordance with an illustrative embodiment of the invention, a carrier offers a “premium” service which comprises marking IP data packets based on whether it has in fact been able to verify the accuracy of the specified IP source address. This marking flag may be implemented with use of a zero/non-zero Type-of-Service (TOS) field value in the IP header, and verification of the source address may be performed with use of a Reverse Path Forwarding (RPF) or other similar such test. The “premium” service is referred to herein as “IP CallerID.”

Multicast capabilities of a link state protocol controlled network are used to accelerate the flooding advertisement of topology change notifications within portions of the network. This flooding mechanism may be particularly efficient in a network with a large number of two-connected nodes such as a ring network architecture. A control plane specific multicast group address is used when flooding topology change notifications, and a process such as reverse path forwarding check is used as an additional control on forwarding of the notification to prevent looping of control plane packets. Two-connected nodes insert a forwarding entry into their FIB to enable frames containing the control message to be forwarded via the data plane on to the downstream node so that propagation of the control message along a chain of two-connected nodes may occur at data plane speeds.

An efficient Reverse Path Forwarding (RPF) check mechanism is disclosed. In one embodiment, when a network node receives a multicast packet on an incoming interface, the network node obtains an expected incoming interface identifier from either a unicast routing table or a multicast forwarding information table. A RPF Flag stored in association with multicast flow information determines from which table the interface identifier is obtained. If the expected incoming interface does not match the actual incoming interface, the multicast packet is discarded.

Systems and methods for implementing a bidirectional multicast protocol with two types of join messages are disclosed. The two types of join messages, upstream joins and downstream joins, are used to control the Reverse Path Forwarding (RPF) interface is added to the outgoing interface list for a particular multicast group, which in turn controls when multicast packets will be forwarded to the rendezvous point. One method involves receiving a multicast packet addressed to multicast group G. The method inhibits the multicast packet from being forwarded via the RPF interface, unless the outgoing interface list corresponding to the multicast group G already identifies the RPF interface. The RPF interface can be added to the outgoing interface list in response to reception of a downstream join message via the RPF interface, as well as in response to monitoring, via the RPF interface, an upstream join message on a shared network segment.

The present invention relates to a satellite IP multicasting system and method for constructing an IP multicast network by a unit of internet node having a router for subscriber connection or a switch, and for transmitting a multicasting packet transmitted from a content provider into a local IP multicast network via a satellite. The satellite IP multicasting system features a backbone network, a content provider, a satellite network and a local network. The local network, which is interworked with the backbone network, is configured to multicasting protocol at a router or a switch, performs reverse path forwarding by static multicasting routing setup on a router or a switch connected to the satellite network via Ethernet and on a subscriber router or by IP designation of the same sub-net with source address of IP header of the multicast packet to an output port of a satellite data receiver and a port of a router connected to the satellite data receiver, and transmits the multicast packet into a terminal client.

The invention discloses a method and equipment for preventing a source address spoofing attack. The method comprises the following steps of: carrying out URPF (Unicast Reverse Path Forwarding) checking on a received message by the equipment, if a checking result is legal, forwarding the message, and if the checking result is illegal, searching routes corresponding to a source IP (Internet Protocol) address of the message in a route original database of the equipment; when an outlet interface of any one of the searched routes is consistent with an inlet interface of the message, forwarding the message according to a target IP address of the message; and if the corresponding routes are not searched or the outlet interfaces of all the searched are not consistent with the inlet interface, discarding the message. The invention avoids false message discards caused by preventing the source address spoofing attack by using the URPF technology.

Multicast link trace Connectivity Fault Management (CFM) is implemented in an Ethernet network by causing nodes on the network which perform Reverse Path Forwarding Check (RPFC) based on packet Source Address (SA) to not update the packet SA when updating the content of the CFM message. Alternatively multicast CFM is implemented by causing nodes on the network to update the packet SA when the content of the CFM message is updated, but cause a secondary RPFC process to be implemented by a control process in connection with processing the CFM message. The secondary RPFC process is based on a combination of source and content contained in the payload of the CFM message.

The invention discloses a method and a device used for realizing unicast reverse path forwarding of an IPv6 network, wherein the method comprises the following steps: an access device intercepts or acquires public messages from a router, wherein address prefix information is carried by the public messages; the access device establishes a prefix table according to the acquired address prefix information; and the access device receives access request messages from a user-side device, judges whether a source IP address of the access request messages is in the prefix table or not and determines whether to forward the messages to the router or not according to the judging result. The invention can realize address filteration and control in the access device.

The invention discloses a method for implementing two-way protocol independent multicast (PIM) and equipment. According to the method, an equivalent routing number for allowed load sharing is configured on each piece of routing equipment in a two-way PIM network; each piece of routing equipment generates corresponding quantity of designated forwarder (DF) election examples according to the equivalent routing number for allowed load sharing and elects a DF interface corresponding to each DF election example, wherein a reverse path forwarding (RPF) interface corresponding to each DF election example is selected from an equivalent routing interface set of the routing equipment by the routing equipment in a polling way; and when generating a multicast forwarding table entry, the routing equipment is matched to the corresponding DF election example according to a corresponding multicast group, acquires the RPF interface which corresponds to the matched DF election example, and generates a corresponding multicast forwarding table entry, wherein the RPF interface in an output interface list in the generated multicast forwarding table entry is the RPF interface which corresponds to the matched DF election example. By the method and the equipment, multicast load sharing can be realized by using equivalent routing.

The invention discloses a reverse path forwarding inspection method and a reverse path forwarding inspection device. The method comprises the following steps: a unicast routing management module informs a multicast routing management module about the information on unicast routing synchronous failure, after knowing an event that the unicast routing synchronization time is larger than the preset time; the multicast routing management module backups unicast routing corresponding to reverse path forwarding (RPF) inspection after knowing the information on unicast routing synchronous failure; and after synchronization failure of the unicast routing corresponding to the RPF inspection, the multicast routing management module performs RPF inspection by utilizing the backup unicast routing. According to the reverse path forwarding inspection method and the reverse path forwarding inspection device, the RPF inspection failure can be avoided after the event that the unicast routing synchronization time is larger than the predetermined time occurs.

Disclosed are methods, apparatus, data structures, computer readable media, mechanisms, and means for maintaining and using a data structure (fig. 2) identifying for multiple addresses the reverse path forwarding information (RPF) for a common intermediate node. A data structure includes an address lookup data structure (250) for identifying leaf nodes (212, 213, 214) of multiple leaf nodes corresponding to matching addresses. Each of the multiple leaf nodes (212, 213, 214) includes a reverse path forwarding indirection (RPF) link to a corresponding sub-data structure (260) indicating reverse path forwarding information (RPF). Each of a particular set of leaf nodes having a same intermediate reachability node (211) in a network includes a particular indirection link to a same particular sub-data structure indicating reverse path forwarding information (RPF). The intermediate reachability node (211) may or may not be a gateway node to a different intranet (200, 210). The intermediate reachability node (211) is typically a node in the network which traffic between a node and multiple other nodes must traverse.

An embodiment of the invention provides a control network determination method and device. The method includes: determining multiple first candidate control networks used for a first controller and multiple forwarding nodes at least according to states of physical links between the first controller and the forwarding nodes corresponding to the first controller; for each forwarding node in each first candidate control network, responding to that control flow of the forwarding node can be transmitted to a second controller via a local rerouting mode or reverse path forwarding mode when fault happens between the forwarding node and a previous single-hop node of the forwarding node in the first candidate control network, and determining the forwarding node as a protectable forwarding node in the first candidate control network; at least according to the number of the protectable forwarding nodes in each first candidate control network, determining an optimal control network from the first candidate control networks.

The invention relates to a method for notifying link status information and determining multicast forward path and a device method. The method comprises the following steps: carrying link status information of a forwarding adjacency-traffic engineering (FA TE) tunnel and a first link type identifier in a link status advertisement (LSA) message, and flooding broadcasting the LSA message; locally storing the received LSA message in a link status database, establishing an unicast routing table and a reverse path forwarding (RPF) routing table according to the information in the database, and initially searching a matching route in the RPF routing table when receiving a multicast message according to the address information carried in the multicast message; searching in the unicast routing table when the matching route is not found in the RPF routing table. The embodiment of the invention can flexibly avoid the TE tunnel interface in the event that a multi-protocol label switching-trafficengineering (MPLS TE) and a multicast protocol are allocated at the same time, and can adapt to the dynamic variation of the network topology and flexibly determine the multicast forwarding path.

The embodiment of the invention discloses an RPF checking method, and the method comprises the steps: enabling a tail node to obtain a multicast source address, a multicast group address and packaginginformation carried in a multicast data message after the tail node receives the multicast data message from a head node; and then, according to the multicast source address, the multicast group address and the first corresponding relationship, a first identifier is acquired for identifying an upstream multicast next-hop UMH node corresponding to the multicast data message. In addition, a tail node can also obtain a second identifier for identifying the head node corresponding to the multicast data message according to the encapsulation information of the multicast data message and the secondcorresponding relationship. After the first identifier and the second identifier are obtained, the tail node can perform RPF check according to the first identifier and the second identifier. In theembodiment of the invention, the data length of the first identifier and the data length of the second identifier are both smaller than 128 bits, so that in the embodiment of the invention, two piecesof data smaller than 128 bits can be compared, and RPF check is simplified.