Back to results
US 7,583,670 B2Granted
Method and system for managing network traffic based on matching criteria
AssigneeCisco Technology, Inc.
InventorAmbika Balakrishnan
Life of this patent
Estimating the term…
Abstract
Methods and systems are provided for managing network traffic in a network device based on matching criteria. The method includes providing a plurality of objects associated with a packet of the network traffic; creating a set of criteria corresponding to the type of objects; and accepting the packet if the plurality of objects satisfies the set of criteria.
Claims21
A method, comprising:
- receiving a signal from a user input device to define an access control list (ACL) in a network device, the ACL having an ACL entry that defines a configuration of transmission control protocol (TCP) flags;
- receiving a signal from the user input device to define a set indication for a first TCP flag in the ACL entry, wherein the defined set indication includes a ‘+’ sign prefixing the first TCP flag in the ACL entry;
- receiving a signal from the user input device to define a not-set indication for a second TCP flag in the ACL entry, wherein the defined not-set indication includes a ‘−’ sign prefixing the second TCP flag in the ACL entry;
- receiving a signal from the user input device to define a match all indication for the defined set and not-set indications in the ACL entry;
- receiving a packet in the network device, the packet having first and second fields associated therewith, the first field corresponding to the first TCP flag, the second field corresponding to the second TCP flag;
- and
- accepting the received packet in the network device if and only if the first field in the received packet is set and the second field in the received packet is not set.
4 more elements
A method, comprising:
- providing a router including an access control list (ACL) having an ACL entry of access flags;
- defining a set indication in the ACL entry for a first access flag by using a ‘+’ sign prefixing the first access flag to indicate that a first packet flag being set in a packet is a first condition for matching;
- defining a not-set indication in the ACL entry for a second access flag by using a ‘−’ sign prefixing the second access flag to indicate that a second packet flag being not set in the packet is a second condition for matching;
- defining a match all indication for the defined set and not-set indications in the ACL entry;
- receiving a packet having packet flags in an ACL interface of the router, the received packet having a first packet flag corresponding to the first access flag, the received packet having a second packet flag corresponding to the second access flag;
- and
- matching in a corresponding one-to-one relationship, the first and second packet flags of the received packet with the first and second access flags of the ACL of the router to satisfy both the first and second conditions for indicating that the received packet is acceptable for transmitting from the router.
4 more elements
A system, comprising:
- means for receiving a packet in a network device, the packet having a plurality of fields associated therewith;
- means for creating an access control list (ACL) in the network device, wherein the ACL comprises a packet flag associated with a configuration of the network device, the packet flag corresponding to a type of at least one field in the received packet;
- means for defining a set indication using a ‘+’ sign in the ACL for a first field in the plurality of fields when the first field being set in the received packet is a first condition for matching, wherein the ‘+’ sign prefixes a representation of the first field in the ACL;
- means for defining a not-set indication using a ‘−’ sign in the ACL for a second field in the plurality of fields when the second field being not set in the received packet is a second condition for matching, wherein the ‘−’ sign prefixes a representation of the first field in the ACL;
- means for defining a match all indication for the defined set and not-set indications in the ACL of the network device;
- means for matching the fields from the received packet with corresponding matching criteria of the ACL;
- and
- means for accepting the packet if and only if the plurality of fields associated with the received packet satisfies both the first and second conditions.
5 more elements
An Access Control List (ACL) interface for determining if a packet is acceptable for transmitting from a router, the ACL interface comprising:
- means for providing an ACL having access flags to the router;
- means for receiving a packet having packet flags in the ACL interface of the router;
- means for defining a set indication using a ‘+’ sign in the ACL for a first access flag to indicate that a first packet flag being set in the received packet is a first condition for matching, wherein the ‘+’ sign prefixes the first access flag in the ACL;
- means for defining a not-set indication using a ‘−’ sign in the ACL for a second access flag to indicate that a second packet flag being not set in the received packet is a second condition for matching, wherein the ‘−’ sign prefixes the second access flag in the ACL;
- means for defining a match all indication for the defined set and not-set indications in the ACL of the router;
- and
- means for matching in a corresponding one-to-one relationship first and second packet flags of the received packet with the first and second access flags of the ACL of the router to satisfy both the first and second conditions for indicating that the received packet is acceptable for transmitting.
4 more elements
An apparatus, comprising:
- A computer processor;
- a computer-readable storage medium including instructions executable by the computer processor, the storage medium comprising:
- one or more instructions for receiving a signal from a user input device to define an access control list (ACL) in a network device, the ACL having an ACL entry that defines a configuration of transmission control protocol (TCP) flags;
- one or more instructions for receiving a signal from the user input device to define a set indication for a first TCP flag in the ACL entry, wherein the defined set indication includes a ‘+’ sign prefixing the first TCP flag in the ACL entry;
- one or more instructions for receiving a signal from the user input device to define a not-set indication for a second TCP flag in the ACL entry, wherein the defined not-set indication includes a ‘−’ sign prefixing the second TCP flag in the ACL entry;
- one or more instructions for receiving a signal from the user input device to define a match all indication for the defined set and not-set indications in the ACL entry;
- one or more instructions for receiving a packet in the network device, the packet having first and second fields associated therewith, the first field corresponding to the first TCP flag, the second field corresponding to the second TCP flag;
- and
- one or more instructions for accepting the received packet in the network device if and only if the first field in the received packet is set and the second field in the received packet is not set.
6 more elements
A computer-readable storage medium including instructions executable by a computer processor, and when executed by the computer processor, operable to perform the following steps:
- receive a signal from a user input device to define an access control list (ACL) in a network device, the ACL having an ACL entry that defines a configuration of transmission control protocol (TCP) flags;
- receive a signal from the user input device to define a set indication for a first TCP flag in the ACL entry, wherein the defined set indication includes a ‘+’ sign prefixing the first TCP flag in the ACL entry;
- receive a signal from the user input device to define a not-set indication for a second TCP flag in the ACL entry, wherein the defined not-set indication includes a ‘−’ sign prefixing the second TCP flag in the ACL entry;
- receive a signal from the user input device to define a match all indication for the defined set and not-set indications in the ACL entry;
- receive a packet in the network device, the packet having first and second fields associated therewith, the first field corresponding to the first TCP flag, the second field corresponding to the second TCP flag;
- and
- accept the received packet in the network device if and only if the first field in the received packet is set and the second field in the received packet is not set.
4 more elements
Dependencies are inferred from the claim text.