Detecting and preventing network loops

Patent metadata

Field	Value
Publication number	US-10110469-B2
Application number	US-201615216666-A
Country	US
Kind code	B2
Filing date	Jul 21, 2016
Priority date	Jul 21, 2016
Publication date	Oct 23, 2018
Grant date	Oct 23, 2018

Abstract

Systems, methods, and non-transitory computer-readable storage media for detecting network loops. In some embodiments, a system can identify a port that is in a blocking state. The blocking state can be for dropping one or more types of packets and preventing the port from forwarding the one or more types of packets. The system can determine a number of packets transmitted through the port by a hardware layer on the system and a number of control packets transmitted through the port by a software layer on the system. The system can determine whether the number of packets is greater than the number of control packets. When the number of packets is greater than the number of control packets, the system can determine that the blocking state has failed to prevent the port from forwarding the one or more types of packets.

First claim

What is claimed is:

1. A computer-implemented method comprising:
identifying a port, on a network device, that is in a blocking state, the blocking state for dropping one or more types of packets and preventing the port from forwarding the one or more types of packets;
determining a first number of packets transmitted through the port by a hardware element on the network device;
determining a second number of control packets transmitted through the port by a CPU process on the network device;
determining whether the first number of packets is greater than the second number of control packets by at least a predetermined number;
when the first number of packets is greater than the second number of control packets by the at least the predetermined number, determining that the blocking state has failed to prevent the port from forwarding the one or more types of packets; and
correcting, in response to a positive outcome of the determining, the failed blocking state by:
disabling the port;
setting the port to a state that allows some traffic to pass while preventing other traffic from passing; and/or
re-configuring one or more links of the port;

wherein the predetermined number is zero or higher.

2. The computer-implemented method of claim 1 , wherein the control packets comprise at least one of bridge protocol data unit (BPDU) packets, link aggregation control protocol (LACP) packets, link layer discovery protocol (LLDP) packets, and cisco discovery protocol (CDP) packets.

3. The computer-implemented method of claim 1 , further comprising:
determining a third number of packets received, by the hardware element, through the port;
determining a fourth number of control packets received, by the CPU process, through the port;
determining a fifth number of received packets associated with the port that are dropped by the hardware element;
determining whether a difference between the third number of packets received by the hardware element and the fifth number of packets dropped by the hardware element, is greater than the fourth number of control packets received by the CPU process; and
when the difference is greater than the fourth number of control packets received, determining that the blocking state has failed to cause the port to drop the one or more types of packets.

4. The computer-implemented method of claim 1 , wherein the port is one of an access port or a trunk port, wherein all virtual local area networks (VLANs) configured on the trunk port are marked as blocked.

5. The computer-implemented method of claim 1 , wherein the port is associated with a first virtual local area network and a second virtual local area network, wherein the port is configured to block one or more types of packets associated with the virtual local area network and forward the one or more types of packets associated with the second virtual local area network, the method further comprising:
determining a third number of packets associated with the second virtual local area network that are transmitted through the port;
subtracting the third number of packets associated with the second virtual local area network from the first number of packets transmitted through the port by the hardware element, to yield a subtracted number of packets;
determining whether the subtracted number of packets is greater than a fourth number of control packets transmitted by the CPU process through the port that are associated with one or more blocked virtual local area networks; and
when the subtracted number is greater than the fourth number of control packets, determining that the blocking state has failed to prevent the port from forwarding the one or more types of packets.

6. The computer-implemented method of claim 1 , wherein the port is associated with a first virtual local area network and a second virtual local area network, wherein the port is configured to block packets associated with the virtual local area network and forward packets associated with the second virtual local area network, the method further comprising:
determining a third number of packets received, by the hardware element, through the port;
determining a fourth number of control packets received, by the CPU process, through the port, the fourth number of control packets being associated with one or more blocked virtual local area networks;
determining a fifth number of received packets associated with the port that are dropped by the hardware element, the fifth number of received packets being associated with the one or more blocked virtual local area networks;
determining a sixth number of packets associated with the second virtual local area network that are received through the port;
subtracting the sixth number of packets associated with the second virtual local area network and the fifth number of received packets associated with the port that are dropped by the hardware element, from the third number of packets received through the port by the hardware element, to yield a subtracted number of packets;
determining whether the subtracted number of packets is greater than the fourth number of control packets received by the CPU process through the port; and
when the subtracted number is greater than the fourth number of control packets received by the CPU process, determining that the blocking state has failed to cause the port to drop the one or more types of packets.

7. The computer-implemented method of claim 1 , wherein the first number of packets transmitted comprises a rate of packets transmitted, and wherein the second number of control packets transmitted comprise a rate of control packets received.

8. The computer-implemented method of claim 1 , wherein the one or more types of packets comprises all packets excluding the control packets, wherein the hardware element comprises an application specific integrated circuit.

9. A network device comprising:
one or more processors; and
a computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
identifying a port on the network device that is in a blocking state, the blocking state for dropping one or more types of packets and preventing the port from forwarding the one or more types of packets;
determining a first number of packets transmitted through the port by a hardware element on the network device;
determining a second number of control packets transmitted through the port by a CPU process on the network device;
determining whether the first number of packets is greater than the second number of control packets by at least a predetermined number; and

when the first number of packets is greater than the second number of control packets by the at least the predetermined number, detecting an error associated with the blocking state, the error comprising a failure to prevent the port from forwarding the one or more types of packets; and
correcting, in response to a positive outcome of the determining, the failed blocking state by:
disabling the port;
setting the port to a state that allows some traffic to pass while preventing other traffic from passing; and/or
re-configuring one or more links of the port;
wherein the predetermined number is zero or higher.

10. The network device of claim 9 , wherein the control packets comprise at least one of bridge protocol data unit (BPDU) packets, link aggregation control protocol (LACP) packets, link layer discovery protocol (LLDP) packets, and cisco discovery protocol (CDP) packets.

11. The network device of claim 9 , the computer-readable medium having stored therein instructions which, w

Assignees

• Cisco Tech Inc

Inventors

• Manthiramoorthy Natarajan
• Srinivasan Venkatesh
• Narayanan Swaminathan
• Mehta Ambrish Niranjan
• Singh Anand Kumar
• Chodey Anulekha

Classifications

• H04L49/354

  for supporting virtual local area networks [VLAN] · CPC title

• H04L5/0012

  Hopping in multicarrier systems · CPC title

• H04L45/28

  using route fault recovery · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04L45/32

  Flooding (denial of service attacks H04L63/1458) · CPC title