Cisco Technology, Inc.

Norbert Brotz

David Delano Ward

John H W Bettink

Paul Mattes

Jianyu Chen

Packets destined for the route processor of a packet switching device are rate controlled. Typically, line cards are configured to rate limit packets of offending packet flows destined for the route processor, such, but not limited to in response to a quantity of packets in the route processor. Filtering of packets of offending packet flows at the line cards reduces the work required of the route processor.

Rate controlling of packets destined for the route processor

Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms, for identifying admission control policies and enforcement of these admission control policies on packets destined for a route processor. A typical routing device includes: a route processor, a forwarding lookup mechanism for identifying packets destined for the route processor; a lookup mechanism for identifying admission control parameters for packets destined for the route processor; and an admission control enforcement mechanism for enforcing the identified admission control policy parameters for the packets.

Dynamically controlling the rate and internal priority of packets destined for the control plane of a routing device

Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms, for a route processor adjusting admission control policies for packets destined for the route processor and enforced on line cards. Individual line cards can identify offending packet flows that pass through them. However, for example, it is possible that an attack on the route processor might comprise packets being forwarded to the route processor from different line cards, with these packets belonging to a same or different packet flow. By monitoring and identifying offending packet flows, the route processor can inform at least the line cards corresponding to these offending packet flows in order to adjust their corresponding admission control policies to combat such an attack, while typically allowing legitimate traffic to continue to flow at the desired rate to the route processor.

Growing community of inventors

Saint Paul, MN, United States of America

Norbert Brotz