Per-Interface ACL Counters for Precise Rule-Hit Visibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current ACL counter systems in networking devices lack the ability to provide per-interface insights, leading to inadequate visibility and troubleshooting capabilities due to the aggregation of counter values across all interfaces, which can result in unintentional traffic allowance or denial from specific ports.
Innovation Solution
Implementing a per-interface ACL counter system that includes a statistics metadata module to add interface IDs to packets, an expansion module to map these IDs to unique expansion indices, and a counter engine to store and increment counts per interface, allowing for deeper insight into ACL rule application and effectiveness on a per-interface basis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a single aggregated counter is used for ACL rules across all interfaces, then the device complexity is reduced and resource consumption is lowered, but the measurement precision and troubleshooting capability are degraded due to lack of per-interface visibility
Solution Approach 1:
The patent segments the counter system into multiple independent per-interface counters, with each counter tracking ACL rule matches for a specific interface. This segmentation enables precise measurement of ACL effectiveness per interface while maintaining manageable complexity through modular counter organization and selective deployment based on operational needs.
2Loss of information
If per-interface counters are implemented for all ACL rules, then the measurement precision and troubleshooting capability are improved, but the device complexity and resource consumption increase significantly
Solution Approach 1:
The patent applies local quality by implementing per-interface counters selectively based on the specific operational requirements of each interface. Not all interfaces require detailed per-interface counter monitoring - the system applies counter resources locally where needed, optimizing the balance between information retention and system complexity by tailoring the monitoring granularity to each interface's importance and traffic characteristics.
3Productivity
If aggregated counter values are used across all interfaces, then the resource consumption is reduced and counter management is simplified, but the ability to detect and measure interface-specific issues is degraded
Solution Approach 1:
The patent implements a dynamic counter system where the granularity of counter tracking adapts based on operational requirements. The system can dynamically adjust between aggregated and per-interface counter modes, allowing efficient resource utilization during normal operation while enabling detailed interface-specific measurement when troubleshooting or security analysis is required, thus balancing productivity and detectability.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Systems and methods for allocating a per-interface access control list (ACL) counter are disclosed. An ACL is applied to a data packet received at an interface of the network element. In response to matching the highest priority ACL rule, a counter value is obtained based on a combination of a base index and an expansion index value. The base index, expansion index, and counter values are stored in their respective tables. The counter value is uniquely associated with the specific ACL rule hit and the interface used to receive the data packet. Systems and methods also allocate a next set of expansion and counter tables when their storage capacity is exceeded. When the next set of tables are allocated, the older set of tables along with their index mappings and entries are preserved.