Forwarding Database Flooding Mitigation via Ephemeral Queue

The system performs preliminary actions by creating FDB entries with an ephemeral queue status before full confirmation. When a source-MAC flooding attack occurs, these pre-created but unconfirmed entries can be identified and removed from the ephemeral queue, preventing them from consuming permanent FDB resources. This preliminary staging approach allows the system to prepare forwarding entries while maintaining a mechanism to reject malicious entries before they permanently impact system reliability.

The system implements feedback mechanisms through the ephemeral queue that monitors and tracks the status of FDB entries. By continuously monitoring which entries remain in the ephemeral queue versus those confirmed to the permanent FDB, the system can identify patterns of flooding attacks and adjust its behavior accordingly. The feedback loop between entry creation, ephemeral queue monitoring, and confirmation/rejection decisions enables the system to maintain forwarding capability while filtering out malicious traffic patterns.

The invention extracts the transparent VDOM from the communication path by allowing VDOMs to directly access sub-interfaces of physical Ethernet interfaces. This removal of the intermediate TP VDOM eliminates the additional session establishment overhead and double-traversal path, thereby restoring full throughput and concurrent session capacity while maintaining the ability to communicate with external network devices.

The system transitions from a hierarchical communication architecture (through TP VDOM) to a direct interface model where VDOMs can bind to sub-interfaces. This dimensional change in the communication topology allows multiple VDOMs to simultaneously access the physical interface without passing through a single intermediate point, thereby increasing concurrent session capacity and throughput while maintaining communication versatility.