Back to results
US 12,483,460 B2Granted
Network switch and abnormity detecting method
AssigneeRealtek Semiconductor Corp.
InventorsSz-Han Wang, Kai-Wen Cheng, Ming-Dao Chen
Life of this patent
Estimating the term…
Abstract
A network switch is configured to receive packet data. The network switch includes a memory and a processor. The memory is configured to store an access control list and an abnormity detecting program, filter the packet data according to the access control list, and perform an abnormity detecting procedure on the packet data according to the abnormity detecting program. When at least one abnormity event occurs in one of a plurality of time intervals, a counting value increases. When the counting value reaches a counting threshold value, the memory sends an abnormity notification to the processor and the processor performs an abnormity processing procedure on the packet data.
Claims11
A network switch configured to receive packet data, wherein the network switch comprises:
- a memory configured to store an access control list and an abnormity detecting program, filter the packet data according to the access control list, and perform an abnormity detecting procedure on the packet data according to the abnormity detecting program, wherein the access control list comprises a plurality of entries, and each of the plurality of entries corresponds to a rule and an action;
- a processor, wherein when at least one abnormity event occurs in one of a plurality of time intervals, a counting value increases by 1, comprising:
- when a quantity of the at least one abnormity event is two or more than two in the one of the plurality of time intervals, the counting value increases by 1,
- wherein when the counting value reaches a counting threshold value, the memory sends an abnormity notification to the processor and the processor performs an abnormity processing procedure on the packet data,
- wherein the processor is configured to increase the counting threshold value according to a first frequency, greater than an upper limit frequency, of how often the abnormity notification is received and to decrease the counting threshold value according to a second frequency, smaller than a lower limit frequency, of how often the abnormity notification is received, wherein the first frequency is higher than the second frequency,
- wherein the access control list comprises a first control block and a second control block, and the abnormity detecting program comprises a first detecting block and a second detecting block,
- wherein the first detecting block, the first control block, the second control block, and the second detecting block are disposed sequentially in the memory, and the first detecting block and the second detecting block are configured to respectively control the first control block and the second control block to support the abnormity detecting procedure;
- and
- at least one register configured to store a length of each of the plurality of time intervals, the counting threshold value, and an upper limit value, wherein the abnormity event is that a flow value of the packet data reaches the upper limit value.
6 more elements
An abnormity detecting method, comprising:
- receiving, by a network switch, packet data;
- filtering, by a memory of the network switch, the packet data according to an access control list, and performing, by the memory, an abnormity detecting procedure on the packet data according to an abnormity detecting program, wherein the access control list comprises a plurality of entries, and each of the plurality of entries corresponds to a rule and an action;
- increasing a counting value by 1 when at least one abnormity event occurs in one of a plurality of time intervals, comprising:
- increasing the counting value by 1 when a quantity of the at least one abnormity event is two or more than two in the one of the plurality of time intervals;
- sending, by the memory, an abnormity notification to a processor of the network switch when the counting value reaches a counting threshold value, wherein the processor performs an abnormity processing procedure on the packet data, comprising:
- increasing the counting threshold value according to a first frequency, greater than an upper limit frequency, of how often the abnormity notification is received;
- and
- decreasing the counting threshold value according to a second frequency, smaller than a lower limit frequency, of how often the abnormity notification is received, wherein the first frequency is higher than the second frequency,
- wherein the access control list comprises a first control block and a second control block, and the abnormity detecting program comprises a first detecting block and a second detecting block,
- wherein the first detecting block, the first control block, the second control block, and the second detecting block are disposed sequentially in the memory, and the first detecting block and the second detecting block are configured to respectively control the first control block and the second control block to support the abnormity detecting procedure;
- and
- storing, by at least one register, a length of each of the plurality of time intervals, the counting threshold value, and an upper limit value, wherein the abnormity event is that a flow value of the packet data reaches the upper limit value.
9 more elements
Dependencies are inferred from the claim text.