# US 12,015,556 B2 · Method, apparatus, and system for generating, and processing packets according to, a flow filtering rule > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,556 B2 - Document ID: US12015556B2 - Status: Granted - Kind: B2 - Application number: 18/156,175 - Filed: 2023-01-18 - Published: 2023-06-08 - Granted: 2024-06-18 - Earliest claimed: 2018-08-30 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Hong Wu; Jianbo Zhu; Ruiqing Cao; Zhenbin Li - Web page: https://patentgrep.com/patent/US12015556B2 ## CPC - H04L 45/64: using an overlay routing layer - H04L 45/04: {Interdomain routing, e.g. hierarchical routing} - H04L 45/38: {Flow based routing} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0263: {Rule management} - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 63/1458: {Denial of Service} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A packet processing method and apparatus, and a related device, the method including generating, by a first device, a flow filtering rule, where the flow filtering rule includes a match item and an action item, and where the match item comprises an Internet Protocol (IP) address and an autonomous domain identifier, and sending, by the first device, the flow filtering rule to a second device, where the action item is used to instruct the second device to process, based on a packet processing mode indicated by the action item, a packet matching the match item. ## Claims ### Claim 1 A method, comprising: generating, by a first device, a flow filtering rule, wherein the flow filtering rule comprises a match item and an action item, wherein the match item comprises a source Internet Protocol (IP) address and an autonomous domain identifier, and wherein the autonomous domain identifier is an identifier of an autonomous domain to which a destination IP address belongs; and sending, by the first device, the flow filtering rule to a second device, wherein the action item instructs the second device to process, based on a packet processing mode indicated by the action item, a packet matching the match item, the packet matching the match item comprising a source IP address of the packet matching the source IP address of the match item and an autonomous domain identifier to which a destination IP address of the packet belongs matching the autonomous domain identifier of the match item. ### Claim 2 (depends on 1) The method according to claim 1, wherein: the first device comprises a Border Gateway Protocol (BGP) flow specification server; and sending, by the first device, the flow filtering rule to the second device comprises sending, by the BGP flow specification server, the flow filtering rule to the second device. ### Claim 3 (depends on 1) The method according to claim 1, wherein the packet processing mode indicated by the action item comprises one or more of discarding the packet, redirecting the packet, or marking the packet. ### Claim 4 A method, comprising: receiving, by a second device, a flow filtering rule sent by a first device, wherein the flow filtering rule comprises a match item and an action item, wherein the match item comprises a source Internet Protocol (IP) address and an autonomous domain identifier, and wherein the autonomous domain identifier is an identifier of an autonomous domain to which a destination IP address belongs; receiving, by the second device, a packet; and processing, by the second device, the packet based on a packet processing mode indicated by the action item, wherein a source IP address of the packet matches the source IP address of the match item, and wherein an autonomous domain identifier to which a destination IP address of the packet belongs matches the autonomous domain identifier of the match item. ### Claim 5 (depends on 4) The method according to claim 4, wherein: the first device comprises a Border Gateway Protocol (BGP) flow specification server that sends the flow filtering rule to the second device; and receiving, by the second device, the flow filtering rule sent by the first device comprises receiving, by the second device, the flow filtering rule sent to the second device by the BGP flow specification server. ### Claim 6 (depends on 4) The method according to claim 4, wherein the packet processing mode indicated by the action item comprises one or more of discarding the packet, redirecting the packet, or marking the packet. ### Claim 7 (depends on 4) The method according to claim 4, further comprising: generating an access control list according to the flow filtering rule, wherein the access control list stores the IP address of the match item, an autonomous domain index, and the action item of the match item, the autonomous domain index corresponding to the autonomous domain identifier of the match item; determining, by the second device, that the packet matches the match item of the flow filtering rule, wherein determining that the packet matches the match item of the flow filter rule comprises determining that the source IP address of the packet matches the source IP address of the match item stored in the access control list, and comprises determining that the autonomous domain identifier to which the destination IP address of the packet belongs matches the autonomous domain index stored in the access control list; and processing, by the second device in response to determining that the packet matches the match item of the flow filtering rule, the packet based on the packet processing mode indicated by the action item stored in the access control list. ### Claim 8 A first device, comprising: at least one processor; and one or more memories coupled to the at least one processor and storing instructions for execution by the at least one processor, wherein the instructions, when executed by the at least one processor, cause the first device to: generate a flow filtering rule, wherein the flow filtering rule comprises a match item and an action item, wherein the match item comprises a source Internet Protocol (IP) address and an autonomous domain identifier, and wherein the autonomous domain identifier is an identifier of an autonomous domain to which a destination IP address belongs; and send the flow filtering rule to a second device, wherein the action item instructs the second device to process, based on a packet processing mode indicated by the action item, a packet matching the match item, the packet matching the match item comprising a source IP address of the packet matching the source IP address of the match item and an autonomous domain identifier to which a destination IP address of the packet belongs matching the autonomous domain identifier of the match item. ### Claim 9 (depends on 8) The first device according to claim 8, wherein: the first device comprises a Border Gateway Protocol (BGP) flow specification server. ### Claim 10 (depends on 8) The first device according to claim 8, wherein the packet processing mode indicated by the action item comprises one or more of discarding the packet, redirecting the packet, or marking the packet. ### Claim 11 A second device, comprising: at least one processor; and one or more memories coupled to the at least one processor and storing instructions for execution by the at least one processor, wherein the instructions, when executed by the at least one processor, cause the second device to: receive a flow filtering rule sent by a first device, wherein the flow filtering rule comprises a match item and an action item, wherein the match item comprises a source Internet Protocol (IP) address and an autonomous domain identifier, and wherein the autonomous domain identifier is an identifier of an autonomous domain to which a destination IP address belongs; and process, in response to receiving a packet, the packet based on a packet processing mode indicated by the action item, wherein a source IP address of the packet matches the source IP address of the match item, and wherein an autonomous domain identifier to which a destination IP address of the packet belongs matches the autonomous domain identifier of the match item. ### Claim 12 (depends on 11) The second device according to claim 11, wherein: the first device comprises a Border Gateway Protocol (BGP) flow specification server that sends the flow filtering rule to the second device. ### Claim 13 (depends on 11) The second device according to claim 11, wherein the packet processing mode indicated by the action item comprises one or more of discarding the packet, redirecting the packet, or marking the packet. ### Claim 14 (depends on 11) The second device according to claim 11, wherein the instructions, when executed by the at least one processor, cause the second device to: generate an access control list according to the flow filtering rule, wherein the access control list stores the IP address of the match item, an autonomous domain index, and the action item of the match item, the autonomous domain index corresponding to the autonomous domain identifier of the match item; and determine that the packet matches the match item of the flow filtering rule, wherein determining that the packet matches the flow filtering rule comprises determining that the source IP address of the packet matches the source IP address of the match item stored in the access control list, and comprises determining that the autonomous domain identifier to which the destination IP address of the packet belongs matches the autonomous domain index stored in the access control list; and process, in response to determining that the packet matches the match item of the flow filtering rule, the packet based on the packet processing mode indicated by the action item stored in the access control list. ### Claim 15 A system, comprising: a first device configured to: generate a flow filtering rule, wherein the flow filtering rule comprises a match item and an action item, wherein the match item comprises a source Internet Protocol (IP) address and an autonomous domain identifier, and wherein the autonomous domain identifier is an identifier of an autonomous domain to which a destination IP address belongs; and send the flow filtering rule; and a second device configured to: receive the flow filtering rule sent by the first device; and process, in response to receiving a packet and further in response to a source IP address of the packet matching the source IP address of the match item and an autonomous domain identifier to which a destination IP address of the packet belongs matching the autonomous domain identifier of the match item, the packet based on a packet processing mode indicated by the action item. ### Claim 16 (depends on 15) The system according to claim 15, wherein: the first device comprises a Border Gateway Protocol (BGP) flow specification server. ### Claim 17 (depends on 15) The system according to claim 15, wherein the packet processing mode indicated by the action item comprises one or more of discarding the packet, redirecting the packet, or marking the packet. ### Claim 18 (depends on 15) The system according to claim 15, wherein the second device is configured to: generate an access control list according to the flow filtering rule, wherein the access control list stores the IP address of the match item, an autonomous domain index, and the action item of the match item, the autonomous domain index corresponding to the autonomous domain identifier of the match item; and determine that the packet matches the match item of the flow filtering rule, wherein determining that the packet matches the flow filtering rule comprises determining that the source IP address of the packet matches the source IP address of the match item stored in the access control list, and comprises determining that the autonomous domain identifier to which the destination IP address of the packet belongs matches the autonomous domain index stored in the access control list; and process, in response to determining that the packet matches the match item of the flow filtering rule, the packet based on the packet processing mode indicated by the action item stored in the access control list.