Delayed Auto New Address Learning in Network Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ethernet switching devices face challenges in efficiently managing new MAC addresses for packet forwarding, particularly in ensuring security controls can prevent unauthorized addresses from being learned, which existing systems often fail to address effectively.
Innovation Solution
A network device with a packet processor separate from the CPU that performs delayed auto new address learning, allowing provisional entries to be upgraded to learned entries after a predetermined time, enabling the CPU to verify the safety of new addresses and prevent unauthorized learning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the packet processor immediately adds new MAC addresses to the forwarding database, then packet forwarding speed is improved, but security control is weakened because the CPU cannot verify new addresses in time
Solution Approach 1:
The patent applies preliminary action by creating a provisional entry in the forwarding database before the CPU completes security verification. When a new MAC address is detected, the packet processor immediately creates a provisional entry that allows packet forwarding while the CPU verifies the address security. This resolves the contradiction by enabling fast forwarding (improving speed) while maintaining security verification capability (preserving reliability) through the temporary provisional state.
2Reliability
If the packet processor communicates with the CPU for every new MAC address, then security control is improved, but processing efficiency deteriorates due to increased CPU traffic
Solution Approach 1:
The patent applies partial action by implementing a two-tier entry system where only provisional entries require CPU verification. The packet processor handles routine packet forwarding using existing learned entries without CPU intervention, while only new provisional entries trigger CPU security checks. This resolves the contradiction by minimizing CPU traffic (improving productivity) while maintaining security control for necessary cases (preserving reliability).
Solution Approach 2:
The packet processor performs self-service by autonomously managing the forwarding database with provisional and learned entries. It can independently add provisional entries, upgrade them to learned entries, and remove entries without constant CPU intervention. This self-service capability reduces CPU traffic overhead while maintaining security through selective CPU verification, resolving the contradiction between security control and processing efficiency.
3Measurement precision
If the forwarding database stores all MAC addresses immediately, then packet forwarding accuracy is improved, but memory usage increases and security risks arise from storing unverified addresses
Solution Approach 1:
The patent applies local quality by differentiating between two types of database entries with different properties: provisional entries (temporary, require verification) and learned entries (permanent, verified). This local differentiation allows the system to store only verified addresses permanently in memory while using temporary provisional entries for unverified addresses during the verification process. This resolves the contradiction by optimizing memory usage (reducing quantity) while maintaining forwarding accuracy for verified entries (preserving precision).
Data Source
AI summary
A network device includes a plurality of ports and at least one packet processor separate from a central processing unit (CPU). The packet processor is configured to forward a received packet based on a look-up of a destination address of the received packet in a table of learned entries that associate first addresses checked by the CPU to the ports of the network device, to add a new provisional entry that associates a source address with an ingress port of the received packet based on a look-up of the source address in both the learned entries and provisional entries that associate second addresses to be checked by the CPU to the ports of the network device, and to upgrade the new provisional entry to a learned entry with a delay time (e.g., a pre-determined time period) to allow the CPU to check the source address.