Systems and methods of handling access control violations
AssigneeHewlett-Packard Development Company, L.P.
InventorHrishikesh Narasimhan
Life of this patent
Estimating the term…
Abstract
Systems and methods of reporting access violations in a network device are disclosed. One such method comprises setting a forwarding index field in a specific entry of an access control list (ACL) to reference a specific forwarding table entry (FTE). The specific FTE is the only FTE associated with reporting access violations. The method further comprises setting a next destination field in the specific FTE to indicate a copy-to-processor behavior. The method further comprises setting the next destination field in the specific FTE to indicate a drop behavior. The setting of the next destination field is responsive to a timeout on a timer associated with reporting access violations.
Claims15
A method of handling access violations in a network device, the method comprising:
- setting, by at least one processor, a forwarding index field in a specific entry of an access control list (ACL) to reference a specific forwarding table entry (FTE), the specific FTE being the only FTE associated with reporting access violations;
- setting, by the at least one processor, a next destination field in the specific FTE to indicate a copy-to-host processor operation;
- and
- responsive to a timeout on a timer associated with reporting access violations, setting, by the at least one processor, the next destination field in the specific FTE to indicate a drop operation.
A method of handling access violations in a network device, the method comprising:
- setting, by at least one processor, a forwarding index field in a specific entry of an access control list (ACL) to reference a specific one of a plurality of forwarding table entries (FTEs), the plurality of FTES associated with reporting access violations for a group of entries in the ACL;
- setting, by the at least one processor, a next destination field in the specific one of the FTEs to indicate a copy-to-host processor operation;
- and
- responsive to a timeout on a timer associated with reporting access violations for the group of entries in the ACL, setting, by the at least one processor, the next destination field in the specific one of the FTEs to indicate a drop operation.
A network device comprising:
- a packet processor;
- memory having instructions stored thereon;
- a processor configured by the instructions to configure the packet processor to:
- set a forwarding index field in a specific entry of an access control list (ACL) to reference a specific one of a plurality of forwarding table entries (FTEs), the plurality of FTES associated with reporting access violations for a group of entries in the ACL;
- set a next destination field in the specific one of the FTEs to indicate a copy-to-host processor operation;
- and
- responsive to a timeout on a timer associated with reporting access violations for the group of entries in the ACL, set the next destination field in the specific one of the FTEs to indicate a drop operation;
- wherein the packet processor is configured to utilize the ACL and the fowarding table to determine an access violation caused by a packet which matches one of the entries in the ACL, and to either drop the packet or copy the packet to the host processor in accordance with the operation specified by the next destination field in the FTE that is referenced by the matching one of the ACL entries.
Dependencies are inferred from the claim text.