New H3c Technologies Co., Ltd.

Shaoliang An

Kai Ren

Changzhong Ge

A NAT method, apparatus and device are provided. According to the method, a target IP address and its reference port are obtained from a NAT resource pool, the reference port being a port in a corresponding consecutive port range. A first five-tuple is generated based on the target IP address, the reference port and an original five-tuple of the packet, and a second five-tuple is obtained by masking first-class bits of the reference port of the first five-tuple. Based on a hash result of the second five-tuple, a target bit indicating a non-conflicting state is determined from a pre-constructed bitmap. The state indicated by the target bit is set to be a conflicting state, and a target five-tuple is generated based on the target bit. The target five-tuple and the original five-tuple are recorded in a session table, and the packet is NAT-processed based on the target five-tuple.

Network address translation

A Network Address Translation (NAT) method, apparatus and device are provided. Based on the method, a target IP address and its reference port are obtained from a NAT resource pool, wherein the reference port is a port in a consecutive port range of the target IP address; a first five-tuple corresponding to a packet is generated based on the target IP address, the reference port and an original five-tuple of the packet, and a second five-tuple is obtained by masking first-class bits of two classes of ports of the first five-tuple respectively; a target five-tuple is determined in a plurality of consecutive hash buckets of a hash table based on a hash result of the second five-tuple; and the target five-tuple and the original five-tuple are recorded in the hash table and a corresponding result table, and the packet is NAT-processed based on the target five-tuple.

A Multibit Trie is created for routing distribution of IP prefixes in each Virtual Private Network (VPN); and each Multibit Trie is divided into multiple layers. When routing search is performed for an IP address of a VPN, an input key is generated for each layer respectively, the input key of the layer comprises a VPN identifier of the VPN and bits corresponding to all of at least one layer before the layer in the IP address. A calculation is performed for the generated input key of each layer by using a Hash function of the layer, and routing is searched for according to a data structure information pointer of a Sub_Trie node corresponding to a longest Hash hit result.

IP routing search

A Multibit Trie is created for routing distribution of IP prefixes in each Virtual Private Network (VPN). Routing of IP prefixes in the highest level 1&#x2dc;m of the Multibit Trie is expanded to IP prefixes in level m+1 according to a prefix expansion method, wherein m is an integer larger than 1. Each branch of the IP prefixes in the level m+1 of the Multibit Trie is taken as a Branch_Tree, and data structure information of each Branch_Tree is saved. When routing of an IP address in a VPN is to be searched, a Branch_Tree is searched in a Multibit Trie corresponding to the VPN according to the highest m+1 bits of the IP address, and the routing of the IP address is searched in the Branch_Tree.

Growing community of inventors

Beijing, China

Shaoliang An