# US 2014/0156720 A1 · Control plane protection for various tables using storm prevention entries > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0156720 A1 - Document ID: US20140156720A1 - Status: Published application - Kind: A1 - Application number: 13/918,770 - Filed: 2013-06-14 - Published: 2014-06-05 - Earliest claimed: 2012-12-03 - Assignees: Aruba Networks, Inc. - Applicants: Aruba Networks, Inc. - Inventors: Ramsundar Janakiraman; Ravinder Verma; Brijesh Nambiar; Rajesh Mirukula - Web page: https://patentgrep.com/patent/US20140156720A1 ## CPC - H04L 47/28: in relation to timing considerations - H04L 49/3009: {Header conversion, routing tables or routing tags} - H04L 45/566: {Routing instructions carried by the data packet, e.g. active networks} - H04L 47/122: by diverting traffic away from congested entities - H04L 47/19: at layers above the network layer (network arrangements for networked applications for scheduling or organising the servicing of application requests H04L67/60) - H04L 61/25: of the same type - H04L 63/0272: {Virtual private networks} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present disclosure discloses a method and network device for control plane protection for various tables using storm prevention entries. Specifically, the disclosed system receives a first packet, and creates an inactive entry in a table. The system then forwards the first packet from a first processor to a second processor for processing. Also, the system associates the inactive entry with a timestamp indicating when the first packet is forwarded to the second processor, and determines a configured interval (CI) associated with the table. Further, the system compares a difference between a current timestamp and the timestamp associated with the inactive entry against the CI upon receiving a second packet. If the difference is longer than the CI, the system associates the inactive entry with the current timestamp, and forwards the second packet to the second processor for processing. Otherwise, the system discards the second packet. ## Claims ### Claim 1 A method comprising: receiving, by a first processor at a network device, a first packet; creating, by the first processor, an inactive entry based on a source Internet Protocol (IP) address associated with the first packet; forwarding, by the first processor, the first packet to a second processor for processing; and discarding, by one of a plurality of processors, a second packet associated with the source IP address in response to detection of the inactive entry when the second packet is received. ### Claim 2 (depends on 1) The method of claim 1, further comprising: associating, by the network device, the inactive entry with a timestamp indicating a time point when the first packet is forwarded to the second processor by the first processor. ### Claim 3 (depends on 2) The method of claim 2, further comprising: comparing, by the one of the plurality of processors, a current timestamp with the timestamp associated with the inactive entry in response to receiving the second packet; and in response a difference between the current timestamp and the timestamp associated with the inactive entry being longer than a configured interval (CI), associating the inactive entry with the current timestamp; and forwarding the second packet to the first processor for processing. ### Claim 4 (depends on 2) The method of claim 2, further comprising: determining, by the network device, a configured interval (CI) for each type of tables maintained by the network device to facilitate packet processing. ### Claim 5 (depends on 4) The method of claim 4, wherein the CI is determined based on one or more of a packet type, an amount of time a respective processor takes to processing the first packet, and a relative frequency at which the same type of packets are received. ### Claim 6 (depends on 1) The method of claim 1, wherein the inactive entry is created in one or more of a port table, a route table, a virtual local area network (VLAN) table, a route cache, a bridge table, a session policy table, a station table, and a user table. ### Claim 7 (depends on 1) The method of claim 1, wherein the first processor comprises an exception handling processor; wherein the second processor comprises a control plane processor; wherein the plurality of processors comprises a plurality of forwarding processors; and wherein the first processor and the plurality of processors share access to a memory of the network device. ### Claim 8 (depends on 1) The method of claim 1, wherein the inactive entry is created in response to a missing entry in a first table. ### Claim 9 (depends on 1) The method of claim 1, further comprising: determining whether a second entry corresponding to the first packet exists in at least a second table, wherein a first table having a missing entry is dependent upon the second table; in response to the second entry existing in the second table, creating a first entry in the first table for the first packet based on the second entry. ### Claim 10 (depends on 9) The method of claim 9, wherein the first table comprises a session table that does not allow for inactive entry, and wherein the second table comprises a user table. ### Claim 11 A network device having a symmetric multiprocessing architecture, the network device comprising: a plurality of CPU cores; a network interface to receive one or more data packets; and a memory whose access is shared by the dedicated CPU core and the plurality of CPU cores; wherein the plurality of CPU cores are to: receive a first packet; create an inactive entry based on a source Internet Protocol (IP) address associated with the first packet; forward the first packet to a second processor for processing; and discard a second packet associated with the source IP address in response to detection of the inactive entry when the second packet is received. ### Claim 12 (depends on 11) The network device of claim 11, wherein the plurality of CPU cores are further to: associate the inactive entry with a timestamp indicating a time point when the first packet is forwarded to the second processor by the first processor. ### Claim 13 (depends on 12) The network device of claim 12, wherein the plurality of CPU cores are further to: compare a current timestamp with the timestamp associated with the inactive entry in response to receiving the second packet; and in response a difference between the current timestamp and the timestamp associated with the inactive entry being longer than a configured interval (CI), associate the inactive entry with the current timestamp; and forward the second packet to the first processor for processing. ### Claim 14 (depends on 12) The network device of claim 12, wherein the plurality of CPU cores are further to: determine a configured interval (CI) for each type of tables maintained by the network device to facilitate packet processing. ### Claim 15 (depends on 14) The network device of claim 14, wherein the CI is determined based on one or more of a packet type, an amount of time a respective processor takes to processing the first packet, and a relative frequency at which the same type of packets are received. ### Claim 16 (depends on 11) The network device of claim 11, wherein the inactive entry is created in one or more of a port table, a route table, a virtual local area network (VLAN) table, a route cache, a bridge table, a session policy table, a station table, and a user table. ### Claim 17 (depends on 11) The network device of claim 11, wherein the first processor comprises an exception handling processor; wherein the second processor comprises a control plane processor; wherein the plurality of processors comprises a plurality of forwarding processors; and wherein the first processor and the plurality of processors share access to a memory of the network device. ### Claim 18 (depends on 11) The network device of claim 11, wherein the inactive entry is created in response to a missing entry in a first table. ### Claim 19 (depends on 11) The network device of claim 11, wherein the plurality of CPU cores further to: determine whether a second entry corresponding to the first packet exists in at least a second table, wherein a first table having a missing entry is dependent upon the second table; in response to the second entry existing in the second table, create a first entry in the first table for the first packet based on the second entry. ### Claim 20 (depends on 19) The network device of claim 19, wherein the first table comprises a session table that does not allow for inactive entry, and wherein the second table comprises a user table. ### Claim 21 A non-transitory computer-readable storage medium storing embedded instructions for a plurality of operations that are executed by one or more mechanisms implemented within a network device having a symmetric multiprocessing architecture, the plurality of operations comprising: receiving a first packet; creating an inactive entry based on a source Internet Protocol (IP) address associated with the first packet; forwarding the first packet from a first processor to a second processor for processing; associating the inactive entry with a timestamp indicating when the first packet is forwarded to the second processor; determining a configured interval (CI) associated with a table in which the inactive entry is created; comparing a difference between a current timestamp and the timestamp associated with the inactive entry against the CI in response to receiving a second packet associated with the source IP address; in response to the difference being longer than the CI, associating the inactive entry with the current timestamp; and forwarding the second packet to the first processor for processing; and in response to the difference being no longer than the CI, discarding the second packet.