Filtering vlan packets having malformed tpids
AssigneeArista Networks, Inc.
InventorsAnirudh Ramesh Iyer, Satish Kumar Selvaraj, Akhil Ojha, Purushothaman Nandakumaran, Aman Aman-Ul-Haq, Jyothish Kunkumath
Life of this patent
Estimating the term…
Abstract
Malformed VLAN packets can be detected by programming suitable rules in a TCAM in the packet processing pipeline. In some deployments, for example, the TCAM rule(s) can match on the parsed EtherType metadata. More specifically, the match can be based on the EtherType metadata being set to a value equal to known VLAN TPIDs, such as 0x8100, 0x88a8, rather than being set to a standard EtherType.
Claims20
A method in a network device to detect and filter virtual local area network (VLAN) packets, the method comprising:
- receiving an ingress packet, the ingress packet containing one or more VLAN tags;
- determining a starting byte position in the ingress packet based on the one or more VLAN tags contained in the packet;
- storing into a data store data beginning at the starting byte position in the ingress packet;
- using data stored in the data store to identify a matched rule among a plurality of rules stored in a memory of the network device;
- and
- in response to identifying a matched rule, processing the ingress packet in accordance with one or more actions associated with the matched rule, wherein the one or more actions includes dropping the ingress packet.
A network device comprising:
- at least one packet processor;
- and
- a computer-readable storage medium comprising executable code for controlling the at least one packet processor to:
- receive an ingress packet comprising one or more VLAN tags and a payload portion;
- determine a location in the ingress packet based on the one or more VLAN tags in the packet;
- drop the ingress packet when data beginning at the determined location in the ingress packet does not represent a protocol that describes data in the payload portion;
- and
- forward the ingress packet when the data beginning at the determined location in the ingress packet represents a protocol that describes the data in the payload portion.
A network device comprising:
- at least one packet processor;
- a content addressable memory having stored therein a plurality of first rules;
- and
- a computer-readable storage medium comprising executable code for controlling the at least one packet processor to:
- receive an ingress packet comprising one or more VLAN tags;
- store into a data store content in the ingress packet identified based on the one or more VLAN tags in the packet;
- identify a rule from among the plurality of first rules using data stored in the data store;
- and
- process the ingress packet in accordance with one or more actions associated with the identified rule,
- wherein the plurality of first rules comprise match criteria that match on VLAN tag data.
Dependencies are inferred from the claim text.