US 12,483,460 B2
Network switch and abnormity detecting method
Sz-Han Wang, Hsinchu (TW); Kai-Wen Cheng, Hsinchu (TW); and Ming-Dao Chen, Hsinchu (TW)
Assigned to Realtek Semiconductor Corporation, Hsinchu (TW)
Filed by Realtek Semiconductor Corporation, Hsinchu (TW)
Filed on Apr. 8, 2022, as Appl. No. 17/658,445.
Claims priority of application No. 110116270 (TW), filed on May 5, 2021.
Prior Publication US 2022/0360488 A1, Nov. 10, 2022
Int. Cl. H04L 41/0604 (2022.01); H04L 41/0663 (2022.01); H04L 41/0681 (2022.01); H04L 49/55 (2022.01)
CPC H04L 41/0622 (2013.01) [H04L 41/0663 (2013.01); H04L 41/0681 (2013.01); H04L 49/555 (2013.01)] 11 Claims
OG exemplary drawing
 
1. A network switch configured to receive packet data, wherein the network switch comprises:
a memory configured to store an access control list and an abnormity detecting program, filter the packet data according to the access control list, and perform an abnormity detecting procedure on the packet data according to the abnormity detecting program, wherein the access control list comprises a plurality of entries, and each of the plurality of entries corresponds to a rule and an action;
a processor, wherein when at least one abnormity event occurs in one of a plurality of time intervals, a counting value increases by 1, comprising:
when a quantity of the at least one abnormity event is two or more than two in the one of the plurality of time intervals, the counting value increases by 1,
wherein when the counting value reaches a counting threshold value, the memory sends an abnormity notification to the processor and the processor performs an abnormity processing procedure on the packet data,
wherein the processor is configured to increase the counting threshold value according to a first frequency, greater than an upper limit frequency, of how often the abnormity notification is received and to decrease the counting threshold value according to a second frequency, smaller than a lower limit frequency, of how often the abnormity notification is received, wherein the first frequency is higher than the second frequency,
wherein the access control list comprises a first control block and a second control block, and the abnormity detecting program comprises a first detecting block and a second detecting block,
wherein the first detecting block, the first control block, the second control block, and the second detecting block are disposed sequentially in the memory, and the first detecting block and the second detecting block are configured to respectively control the first control block and the second control block to support the abnormity detecting procedure; and
at least one register configured to store a length of each of the plurality of time intervals, the counting threshold value, and an upper limit value, wherein the abnormity event is that a flow value of the packet data reaches the upper limit value.