Tag-based interface between a switching device and servers for use in frame processing and forwarding

Patent metadata

Field	Value
Publication number	US-9667442-B2
Application number	US-90270310-A
Country	US
Kind code	B2
Filing date	Oct 12, 2010
Priority date	Jun 11, 2007
Publication date	May 30, 2017
Grant date	May 30, 2017

Abstract

A data center includes a blade server rack with a switch device in communication with a plurality of servers. To process a frame, the switch device determines, from content in a frame header by the switch device, a port through which to forward the frame to a server. The switch device inserts a value into a particular field, for example, a VLAN (virtual Local Area Network) tag, in the frame header before forwarding the frame. The server performs a specific action related to processing the frame based on the value inserted by the switch device into the particular field in the frame header. The server can modify the value in the particular field of the frame header before returning the frame to the switch device, with the switch device performing a specific action based on the value in the particular field of the frame header as modified by the server.

First claim

What is claimed is:

1. In a data center with a switch device in communication with a plurality of servers, a method of processing an Ethernet frame comprising:
determining, by the switch device, from content in a header of the Ethernet frame received from an initiating system by the switch device, a first of a plurality of ports of the switch device through which to forward the frame to a first server of the plurality of servers;
inserting, by the switch device, a value into a VLAN (virtual Local Area Network) tag in the header of the frame before forwarding the frame, said value representing one or more policies to govern the processing of the frame by the first server;
forwarding, by the switch device, the frame to the first server;
performing, by the first server, a specific action related to processing the frame based on the value inserted into the VLAN tag;
modifying, by the first server, the value in the VLAN tag of the header of the frame before returning the frame to the switch device;
returning the frame, with the VLAN tag modified by the first server, to the switch device; and
forwarding, in response to the switch device receiving the modified VLAN tag from the first server, the frame from the switch device to a second server of the plurality of servers without first returning the frame to the initiating system.

2. The method of claim 1 , wherein the switch device determines the first port through which to forward the frame by:
generating the value based on content in the header of the frame;
accessing a table entry in a table within the switch device using the generated value as an index into the table, wherein table entries map values to the plurality of ports; and
identifying the first port through which to forward the frame in response to the accessed table entry, wherein said one or more policies comprises examining the frame by an intrusion protection system of the first server.

3. The method of claim 1 , wherein said one or more policies comprises examining the frame by a firewall of the first server.

4. The method of claim 1 , wherein said one or more policies further comprises filters to identify a second port of the plurality of ports for forwarding the frame to the second server.

5. The method of claim 4 , further comprising modifying, by the switch device, a current value in the VLAN tag of the header of the frame before redirecting the frame to the second server.

6. The method of claim 1 , wherein the specific action performed by the first server comprises modifying said value in the VLAN tag to signify priority handling to the switch device if the frame is determined to be virus-free, and dropping the frame if a virus is detected in the frame.

7. The method of claim 1 , further comprising the first server: determining the frame requires processing at a different server of the plurality of servers; modifying the value in the VLAN tag of the header of the frame to indicate the frame requires processing at a different server of the plurality of servers; and returning the frame to the switch device.

8. A blade server rack, comprising:
a plurality of servers; and
a switch device having a plurality of ports, the switch device being physically connected to a first of the plurality of servers through a first of the plurality of ports and to a second of the plurality of servers through a second of the plurality of ports, the switch device further comprising a frame forwarder with logic configured to switch frames between the plurality of ports, and a frame processor with logic configured to determine, from content in a header of a received Ethernet frame from an initiating system, the first of the plurality of ports through which to forward the frame to a first of the plurality of servers, the frame processor further comprising logic configured to insert a value into a VLAN (virtual Local Area Network) tag of the header of the frame before the frame forwarder forwards the frame through the first of the plurality of ports determined for forwarding the frame, the value inserted into the VLAN tag communicating a policy for processing the frame to the first of the plurality of servers,
wherein the first of the plurality of servers includes logic configured to modify the value in the VLAN tag of the header of the frame before returning the frame to the switch device, and the frame processor further includes logic configured to perform a specific action based on the modified value when the frame returns to the switch device from the first of the plurality of servers, said modified value signifying the first server is unable to process the frame and the frame requires processing at a different server of the plurality of servers.

9. The blade server rack of claim 8 , wherein the switch device further comprises a table with entries mapping values to the plurality of ports, and wherein the frame processor further includes logic configured to determine the first of the plurality of ports through which to forward the frame by:
generating the value based on content in the header of the frame;
accessing a table entry in the table using the generated value as an index into the table; and
identifying the first of the plurality of ports through which to forward the frame from the accessed table entry, and wherein said policy further comprises examining the frame by an intrusion protection system of the receiving computing system.

10. The blade server rack of claim 8 , wherein said policy provides the frame will be examined by a firewall of the first server.

11. The blade server rack of claim 8 , wherein the modified value further signifies the first of the plurality of servers is overloaded and the specific action performed by the switch device includes redirecting the frame to the second of the plurality of servers without first returning the frame to the initiating system.

12. The blade server rack of claim 11 , wherein the frame processor further includes logic configured to modify the current value in the VLAN tag of the header of the frame before redirecting the frame to the second of the plurality of servers, said policy further providing a filter for identifying a forwarding sequence of the frame.

13. The blade server rack of claim 8 , further comprising modifying, by the switch device, the value in the VLAN tag of the header of the frame before forwarding the frame to the second of the plurality of servers.

14. A data center, comprising:
a plurality of blade server racks, each blade server rack including a plurality of servers and a switch device having a plurality of ports, the switch device being physically connected to a first of the plurality of servers of the blade server rack through a first of the plurality of ports and to a second of the plurality of servers of the blade server rack through a second of the plurality of ports, each switch device further comprising:
a frame forwarder with logic configured to switch a frame received from an initiating system between the plurality of ports of the switch device for forwarding; and
a frame processor with logic configured to determine from content in a header of the frame one of the plurality of ports of the switch device through which to forward the frame, the frame processor further comprising logic configured to insert a value into a VLAN (virtual Local Area Network) tag of the header of the frame before the frame forwarder forwards the frame, the value inserted into the VLAN tag of the header communicating to a recipient device of the frame a policy for processing the frame, said policy providing the frame will be examined by a firewall of a receiving computing system,

Assignees

• Shao Bill
• Gabriel Cynthia Ann
• Chao Tienwei
• IBM

Inventors

• Shao Bill
• Gabriel Cynthia Ann
• Chao Tienwei

Classifications

• H04L49/354

  for supporting virtual local area networks [VLAN] · CPC title

• H04L12/4666 Primary

  Operational details on the addition or the stripping of a tag in a frame, e.g. at a provider edge node · CPC title