Per-MAC Address Storm Control for Network Flood Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current storm control techniques for managing unknown unicast floods in computer networks are suboptimal, leading to bandwidth starvation and processing cycles, while also affecting legitimate traffic and wasting network resources.
Innovation Solution
A method that involves a processor in a network switch adding unknown MAC addresses to a table with timestamps, forwarding frames to non-blocked spanning tree links, and activating a suppression timer if a threshold of frames is exceeded, to discard frames and prevent network flooding.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If storm control techniques limit unknown unicast floods by blocking interfaces when a threshold is reached, then network bandwidth is protected from flooding, but legitimate traffic is also blocked and network resources are wasted
Solution Approach 1:
The patent applies local quality by treating different MAC addresses differently based on their individual frame rate characteristics. Instead of applying a uniform interface-wide block threshold, the system monitors and thresholds are applied per-MAC-address, allowing legitimate traffic from some sources to continue while blocking flood traffic from other sources. This resolves the contradiction by making the control mechanism selective rather than blanket.
Solution Approach 2:
The patent segments the storm control mechanism into per-MAC-address monitoring and thresholding. The frame rate counter 145 and suppression timer 140 operate independently for each unknown MAC address rather than as a single interface-wide mechanism. This segmentation allows the system to protect against floods from specific sources without affecting legitimate traffic from other sources, resolving the contradiction between network protection and legitimate traffic flow.
2Loss of energy
If interface-wide storm control thresholds are applied to limit unknown unicast floods, then network bandwidth is protected, but network resources are wasted due to blocking legitimate traffic
Solution Approach 1:
The system applies local quality by implementing per-MAC-address frame rate monitoring and thresholding rather than interface-wide control. Each unknown MAC address is monitored independently with its own counter 145 and suppression timer 140. This allows the system to conserve bandwidth by blocking only flood traffic from specific sources while allowing legitimate traffic to continue, thus avoiding waste of network resources.
3Loss of information
If unknown unicast frames are flooded to all interfaces to find the destination MAC address, then the destination can be located in the network, but network bandwidth and processing cycles are starved
Solution Approach 1:
The system applies dynamics by implementing adaptive per-MAC-address frame rate thresholding. The threshold 130 is not static but can be adjusted based on network conditions and traffic patterns. The suppression timer 140 duration can also be dynamic, allowing the system to adapt its flood control aggressiveness to current network state. This resolves the contradiction by allowing destination discovery when traffic rates are normal while preventing bandwidth starvation during flood conditions.
Solution Approach 2:
The system changes parameters by implementing per-MAC-address frame rate monitoring and dynamic thresholding. Instead of static interface-wide thresholds, the system tracks frame rates 135 for each unknown MAC address individually and applies suppression 140 selectively. This allows the network to maintain productivity by preventing floods from specific sources while still allowing destination discovery for legitimate unknown unicast traffic.
Data Source
AI summary
An approach is provided for protecting a network from a unicast flood. If the destination MAC address of a frame is not included in a table of unknown MAC addresses, the MAC address is added to the table and the frame is forwarded to non-blocked spanning tree links to find the MAC address in the network. If the MAC address is included in the table, and if a timer for suppressing forwarding of frames is active, the frame is discarded, or if the timer is inactive, a counter for counting received frames is incremented and compared to a threshold value. If the counter is greater than the threshold value, the timer is activated and the frame is discarded. If the counter is not greater than the threshold value, the frame is forwarded to the non-blocked spanning tree links to find the MAC address in the network.