CN101068212B - Device and method for network address translation forwarding - Google Patents

Abstract

The invention provides a device and a method for network address translation forwarding, which are used for completing the forwarding of a data packet between a public network and a private network, and the device comprises: a common network address conversion and forwarding module, which is used for carrying out network address conversion and forwarding of data packets according to a normal mode; wherein, still include: a fast network address conversion and forwarding module, which is used to record the forwarding key information needed by the forwarding of the data packet, when the data packet is received, extract the related information of the data packet, search the fast forwarding entry containing the forwarding key information matched with the related information, if not, the normal network address conversion module performs the normal network address conversion and forwarding, if found, the forwarding key information in the forwarding entry is used to update the related information in the data packet, and directly obtain the routing information from the forwarding entry, and forward the data packet.

Description

A device and method for network address translation and forwarding

technical field

The invention relates to a network communication address conversion method and device, in particular to a method and device for improving network address conversion efficiency between a private network and a public network in a network. the

Background technique

With the rapid development of the Internet, people have regarded the IP network as an indispensable tool in their daily work and life, the network scale is also expanding, and the number of network users is increasing. Therefore, NAT (Network Address Translation, Network Address Translation) technology has become a main method to solve this problem. Its main function is to enable network devices in the private network to access the public network using fewer public network addresses, so that network resources are fully utilized. As a result, public network IP addresses with limited resources can be allocated to more private network users. the

At present, there are two methods for implementing NAT forwarding function: hardware and software: hardware is designed on the basis of hardware such as FPGA, CPLD or ASIC. The biggest advantage of this method is speed, because the speed advantage of hardware is obvious. Therefore, the conversion rate of this implementation method is fast and the efficiency is very high. But the following problem is that the cost of this method is relatively high, so it is only suitable for high-end equipment with high configuration, and it is not suitable for low-end equipment. However, software forwarding is very suitable for use in low-end products because of its flexibility and low cost. But software implementation also has its own limitations. Because the software implementation mostly depends on the operation of the microprocessor, it has the disadvantages of slow conversion speed and low system efficiency. the

The process of NAT conversion of existing software design is mainly by obtaining information including source IP address, source port number, destination IP address, destination port number and the like from the packet, and searching the forwarding entry table established by the first packet. After finding it, replace the IP address and port information, and calculate the checksum. Update the checksum, and then complete the data forwarding by looking up the corresponding forwarding table. In this case, the NAT service will perform more NAT-related processing than the normal service, resulting in a decrease in forwarding performance. And in the use of the network, there is often a situation that the information of the IP address and port number of the message transmitted in a certain period of time is the same or similar, for example: a private network user downloads information from a server on the public network : Movies, music, etc. The information flow is very large. At this time, through NAT conversion, it is necessary to search the NAT forwarding entry table. The hash algorithm usually used, if the conflict chain is very long at this time, then it will appear in each When the message is converted, it must go through this long conflict chain search. The consequence of that is that the efficiency will be very low. the

In the prior art, two schemes of patent CN200510025134 and patent "US6457061" are disclosed. Among them, the patent "CN200510025134" is not dedicated to the field of NAT conversion, and the first data packet of the "flow" needs to be processed first, and cannot be converted and forwarded directly, and its index can only be established in the cache; the patent "US6457061" It is a general method to realize address translation, but its organization table structure is limited to Prtricia tree. the

Contents of the invention

The purpose of the present invention is to propose a kind of device of network address translation and method thereof, to solve in ordinary NAT conversion, because the conflict chain is too long, when each message is converted, it will go through the search of long conflict chain, and the efficiency will be reduced. Very low question. the

In order to achieve the above object, the present invention proposes a network address translation and forwarding device, which is used to complete the forwarding of data packets between the public network and the private network, including: a common network address translation and forwarding module, used to perform Network address translation and forwarding of data packets; which further includes: 

A fast network address translation and forwarding module, used to record the forwarding key information required for forwarding the data packet, when receiving the data packet, extract the relevant information of the data packet, and search for matching information containing the forwarding key information If the fast forwarding entry is not found, the normal network address translation forwarding module is used to forward the normal network address translation, if found, the relevant information in the data packet is updated using the forwarding key information in the fast forwarding entry , and directly obtain routing information from the fast forwarding entry, and forward the data packet. the

The above-mentioned device for network address translation and forwarding, wherein the fast network address translation and forwarding module further includes:

A fast forwarding information recording module, used to record the forwarding key information of the data packet after carrying out ordinary network address translation and forwarding on the data packet without matching forwarding key information;

A fast forwarding information matching module, used to extract relevant information in the data packet after receiving the data packet, and search for a fast network address translation forwarding entry according to the relevant information as a matching condition, if not found, then Handed over to the normal NAT forwarding module for processing, if found, the found forwarding entry is positioned as fast NAT forwarding information that needs to be updated;

A forwarding module, configured to obtain the key forwarding information required for forwarding the data packet from the fast forwarding entry, replace the relevant information in the data packet, and then directly obtain the routing information according to the saved routing index, and forward said packet;

A fast forwarding entry table, including one or more fast forwarding entries, used to store key forwarding information required for fast network address translation forwarding of the data packet;

Wherein, the fast forwarding entry table further includes:

A fast-forwarding information update module, used to sort all fast-forwarding entries according to the length of unused time, and configure the aging time or adopt the default value, regularly check the unused time of the fast-forwarding entries, and delete Time entries, or update entries that exceed the aging time with the forwarding key information of new data packets, and place the updated entries or newly matched entries at the end of the aging sequence and the head of the entry search conflict chain. the

The above-mentioned device for network address translation and forwarding, wherein the forwarding key information further includes: source IP address, source port number, destination IP address, destination port number and message protocol type;

IP address, port number and routing information after network address translation;

Load sharing index, policy routing index and/or VLAN_ID that need to be changed in other services;

Changes in IP addresses and port numbers resulting from network address translation;

Incremental information of the checksum update caused by the change of the lifetime. the

In the above-mentioned device for NAT forwarding, the fast forwarding entry table further includes: a fast forwarding entry table from a private network to a public network, and/or a fast forwarding entry table from a public network to a private network. the

In the above-mentioned device for network address translation and forwarding, the fast forwarding entry table is stored in a memory or a cache memory. the

In order to achieve the above object, the present invention also provides a method for network address translation and forwarding, which is used to complete the forwarding of data packets between the public network and the private network, wherein the method includes:

Step 1, receiving a data packet, extracting the network address translation information in the data packet, and searching for a matching fast forwarding entry containing forwarding key information in the fast forwarding entry table;

Step 2, if not found, then carry out the forwarding of ordinary network address translation, and record the forwarding key information of the data packet in the fast forwarding entry table, if the fast forwarding entry is found, then use the fast forwarding entry Update the relevant information in the data packet by forwarding the key information in the data packet, and directly obtain the routing information from the fast forwarding entry, and forward the data packet;

Wherein, said step 2 further includes:

Step 101, if a matching fast forwarding entry is found, placing the fast forwarding entry at the end of the aging sequence, and placing the fast forwarding entry at the head of the entry search conflict chain;

Step 102, if no matching fast forwarding entry is found, it is judged whether the last use time of the fast forwarding entry currently at the first place in the aging order exceeds the aging time, and if the aging time is not exceeded, the data The packet is forwarded by ordinary network address translation. If the aging time is exceeded, the forwarding key information of the new data packet is used to update the fast forwarding entry that exceeds the aging time, and the updated fast forwarding entry is placed at the end of the aging sequence and the entry search conflict chain of the first. the

The above-mentioned method for network address translation and forwarding, wherein said step 1 further includes:

Step 81, after receiving the data packet, determine whether to perform fast network address translation forwarding;

Step 82, if fast network address translation forwarding is not performed, then carry out common network address translation and route forwarding to the data packet, otherwise, extract the source IP address, source port number, destination IP address and destination port number of the data packet Match the fast forwarding entry with the packet protocol type. the

The above-mentioned method for network address translation and forwarding, wherein said step 1 further includes:

Judge the flow direction of described packet, if by private network to public network, then source IP address and port number are private network IP address and port number, purpose IP address and port number are public network IP address and port number, start to carry out For the matching search of fast forwarding entries, if it is from the public network to the private network, the source IP address and port number are the public network IP address and port number, and the destination IP address and port number are the IPs visible to the public network after the private network address translation Address and port number for matching lookup of fast forwarding entries. the

Compared with the prior art, the advantages of the present invention are reflected in the following three aspects:

1. Avoid the long conflict chain generated when searching for NAT forwarding entries. For example, when a large number of data packets with the same source and destination need to be converted by NAT within a period of time and the conflict chain is too long when searching for NAT conversion entries, due to Each packet may need to go through a long collision chain to find the translation entry, so the forwarding rate is very low. However, in the present invention, the related information of the data packet and the related information of the conversion entry are recorded in a simple and small table item. Get the conversion information at a faster speed and perform NAT conversion, which can greatly improve the conversion rate. the

2. A large number of related key processing information including NAT translation, routing and forwarding, and other services can be stored in the above-mentioned simple table entry. When performing NAT conversion, after extracting these key information, the content of the data packet can be directly updated, including the information obtained from routing lookup, other services such as load sharing index, policy routing index, etc., and due to NAT address conversion and For the increment of the checksum change caused by the change of TTL, etc., a one-step method is adopted to directly update the data packet, reducing the steps of datagram processing. Therefore, the conversion and forwarding speed of the message is greatly improved, and the performance of the system is improved. the

3. Even if the normal NAT processing is performed after the first hit failure, since the key information collection operation has been completed in the previous process, the forwarding performance of the data packets of the fast NAT entries that do not hit will not be greatly affected . the

Description of drawings

Fig. 1 is a device structural representation of the present invention;

Fig. 2 is a schematic diagram of packet flow of the present invention;

Fig. 3 is a schematic diagram of the workflow of the present invention;

Fig. 4 is a schematic diagram of the maintenance process of the fast NAT forwarding table of the present invention. the

Detailed ways

The software-implemented system processing method for fast NAT conversion of the present invention will be described below in conjunction with the accompanying drawings. the

As shown in FIG. 1 , the NAT forwarding device 100 of the present invention includes: a general forwarding module 110 , a general process module for forwarding messages, which completes normal conversion of NAT and normal forwarding of other services. What needs to be done in this module is to perform NAT conversion and data packet forwarding in the normal way. The business processing information is uniformly maintained in a table item during configuration or when the first packet is processed. When converting and forwarding, this table item is searched for entries according to the obtained package information, and updated according to the entry information. After the data packet, then look for routing forwarding. Each packet is very time-consuming through this process, so the purpose of the present invention is to improve the forwarding rate in the following fast forwarding module. the

The fast NAT forwarding module 120 is an important module of the present invention, and its main work is fast NAT conversion and fast forwarding of data packets. It mainly includes a fast forwarding information recording module 121 , a fast forwarding entry matching module 122 , a forwarding module 123 , a fast NAT forwarding table 124 and a fast forwarding information update module 125 . the

Fast forwarding information recording module 121, the premise of this module is that after the fast forwarding function is opened and used, the processing process of an unfamiliar message entering the system is as follows. First, the message will be forwarded according to the normal forwarding process. After the forwarding is completed, Make a record of forwarding key information. Stored in a temporary table, the information includes the source IP address, source port number, destination IP address, destination port number, message protocol type, IP address after NAT conversion, port number, routing information, and other services of the data packet. The key information that needs to be changed, such as load sharing index, policy routing index, VLAN_ID number, etc., as well as information such as the change of IP address and port number due to NAT conversion, and the increment of checksum update caused by the change of TTL . the

Fast forwarding entry matching module 122, this module plays the role of judging and positioning in the present invention. The so-called judgment means that when the NAT fast forwarding function is enabled, after receiving the data packet, the matching conditions are extracted from the data packet, including source IP address, source port number, destination IP address, destination port number, and packet protocol type , use these conditions as credentials for matching lookup NAT fast forwarding entries. Once the entry is found, fast NAT forwarding can be performed directly according to the found entry, otherwise normal NAT forwarding will be performed, but after the normal NAT forwarding is completed, the key forwarding information should be recorded and saved to the NAT fast forwarding entry to go. In case the following packets with the same source IP address, source port number, destination IP address, destination port number, and packet protocol type can be matched and found for fast forwarding. The so-called positioning means that when a data packet is received to match a fast forwarding entry, the found fast forwarding entry is positioned as information that needs to be updated for fast NAT forwarding. NAT includes other services, and the key information needed for routing forwarding is all stored in this NAT fast forwarding entry table 124, so when performing business forwarding, the required forwarding key information to be updated directly from the fast The forwarding entry table 124 is obtained without recalculating or searching the service forwarding table, including the routing index. It is also stored in it, and can be obtained directly, without the need for tedious routing lookups. the

The forwarding module 123, the function of this module is to obtain the key information that may be changed during the forwarding of the message from the fast forwarding entry table 124, and replace the information in the data packet. Then according to the saved routing index, the routing information is directly obtained and forwarded. the

Fast forwarding entry table 124, this table is established to save the key information needed during NAT fast forwarding. Generally, when the first packet is forwarded normally, it is collected and saved. It can be stored in cache (cache memory) or in memory. The information stored in it is the source IP address, source port number, destination IP address, destination port number, packet protocol type, IP address after NAT conversion, port number, routing information, and other key information that needs to be transformed in the business, such as Load sharing index, policy routing index, VLAN_ID number, etc., as well as information such as the change of IP address and port number caused by NAT conversion, and the increment of checksum update caused by the change of TTL (time to live). the

The fast forwarding information update module 125 is configured to sort all fast forwarding entries according to the length of the unused time, and configure the aging time or adopt a default value, regularly check the unused time of the fast forwarding entry, and delete the unused time of the fast forwarding entry. entries, or update entries that exceed the aging time with forwarding key information of new data packets, and place the updated entries or newly matched entries at the end of the aging sequence and the head of the entry search conflict chain. the

Because the fast forwarding entry table 124 will save many information, so each table item of this table will be big, but because need fast forwarding, so the table number of fast forwarding entry table 124 needn't set up too much, so that guarantee in fast When NAT forwards, the entry can be found quickly, and then the conversion speed can be improved. The fast forwarding information update module 125 adopts an aging mechanism, that is, retains the forwarding key information of the message that has been forwarded recently within a period of time, and monitors the fast forwarding entry. The appearance of the data packet can delete the entry, so as to make room for other attribute data packets to save key information for fast forwarding. When searching the fast forwarding entry table 124, since the length of the entry is not too long, and the aging mechanism is constantly updated, after the data packet information is hashed, it is possible to search for very short or even no conflicts To obtain the required entries, this conflict chain is much shorter than the conflict chain to be searched when the ordinary NAT forwards the lookup table, and the probability of encountering is much smaller. Therefore, more time can be saved in the process of table lookup and the conversion rate can be improved. the

In addition, the efficiency can be further improved on this basis, because as long as the conflict chain is searched, even if the conflict chain of the NAT fast forwarding entry is very short, if data packets with many attributes are continuously forwarded for a period of time, each packet must After searching these conflicting chains, it will still take some time. Therefore, in order to further improve efficiency, when an entry is found in the current data packet, or when an entry is created (by default, the next following packet has the same attribute), or after a certain number of forwardings (after a certain number of forwardings) Just can have more possible follow-up packets all be the same attribute), its forwarding entry is moved to the head of the chain, so that the data packet can be found faster during fast NAT forwarding, and the forwarding efficiency is improved. the

As shown in Figure 2, it is a schematic diagram of the flow of data packets, including:

Step S201, the system receives the data packet;

Step S202, judging whether to enable the fast NAT function, if so, then enter step S205, if not, then enter step S203;

Step S203, start common NAT conversion;

Step S204, message forwarding ends;

Step S205, extract the information required for NAT conversion, and perform fast entry matching, if not matched, then enter step S208, if matched, then enter step S206;

Step S206, matching the fast NAT forwarding entry;

Step S207, after the entry is matched, quickly perform NAT conversion and route forwarding, the system obtains key information from the entry, and modifies the data packet. Make the data packet complete NAT conversion and other business operations, and directly obtain the information of the routing index for routing and forwarding to achieve fast forwarding processing;

Step S208, if there is no matching entry, the system will regard the data packet as the first packet, that is, the first packet when a section of the same data flow arrives, and this packet will often leave key forwarding information for subsequent data packets to use directly. Because these data packets all have the same attributes, then, the first packet enters the normal NAT;

Step S209, after the ordinary NAT is completed, record the fast forwarding entry, if the fast NAT function has been turned on, then the key information obtained by each operation process is recorded and stored in the fast forwarding entry entry 124;

Step S210, message forwarding ends. the

Since the fast NAT forwarding entry has been saved when the first packet is forwarded, when the subsequent data packet with the same attribute as the first packet enters the NAT process, and the information required for NAT conversion in the data packet is extracted for fast entry matching, it can be matched entry. the

As shown in FIG. 3 , it is a schematic flow chart of the fast NAT forwarding method. The main steps are as follows:

Step S301, receive the data packet, enter the IPV4 packet processing flow after processing, judge whether to enter the NAT flow by the incoming interface and the outgoing interface; enter the NAT processing flow;

Step S302, judge whether to enable the fast NAT function, if not enable, just proceed to step S303 and step S304; if enable, just proceed to step S305;

Step S303, performing common NAT translation;

Step S304, performing ordinary forwarding of other services, and performing ordinary route lookup and forwarding. It should be noted here that some services will perform routing lookup during operation, and the routing index will change. end of data flow;

Step S305, if the fast NAT forwarding function is enabled, the data packet is extracted, including the following information: source IP address, source port number, destination IP address, destination port number, message protocol type;

Step S306, check the sending direction of the data packet, whether it is from the public network to the private network or from the private network to the public network, if it is from the private network to the public network, go to step S307, if it is from the public network to the private network, go to step S316 ;

What I want to explain here is that no matter which direction the data packet flows from to that direction, the process of fast NAT forwarding is basically the same. The difference is that when the fast forwarding entry table 124 is established according to the direction from the private network to the public network, if the data packet is forwarded from the private network to the public network, the source IP address and port number are the private network IP address and port number The destination IP address and port number are the IP address and port number of the public network; when the data packet is forwarded from the public network to the private network, the source IP address and port number are the IP address and port number of the public network, and the destination IP address and port number are the visible IP address and port number of the public network after private network conversion, because the relevant information will be established in the fast forwarding entry table 124, that is, the IP address after NAT conversion, port number information, so, in matching When searching, pay attention to the destination IP address and port number when going from the public network to the private network. What needs to be matched is the converted IP address and port number, not the IP address and port number of the private network, which is invisible. the

What has been said above is to pay attention to the two-way retrieval of an entry table. If the fast forwarding entry table 124 is established according to the direction from the public network to the private network, the above process is substantially the same and will not be repeated. Of course, if the resource space permits, a table from the public network to a private network and a table from the private network to the public network can be respectively established in the fast forwarding entry table 124 . the

In addition, when NAT is forwarded from the public network to the private network, after the NAT conversion, the route search may be performed. Here, the search for the route will be a very time-consuming behavior. Therefore, after using fast NAT forwarding, in The routing information has been directly saved in the fast entry table 124, so it is not necessary to waste time searching for the routing here, and the routing index information can be obtained directly in one step. the

The following steps will no longer distinguish the forwarding direction of the data packet;

Step S307, use the packet information source IP address, source port number, destination IP address, destination port number and message protocol type obtained in step S305 to search for the fast forwarding entry according to this information, if no entry is matched, then enter step S307 S313; otherwise, the forwarding entry is matched, so that key information about NAT, routing, and services inside can be extracted. Prepare for the following fast NAT forwarding, proceed to step S308;

Step S308, start NAT fast forwarding;

Step S309, obtaining the converted public network IP address and port number in the fast NAT forwarding entry;

Step S310, replace the IP address and port, and perform a checksum update. The checksum increment due to the change, this checksum increment includes a uniform increment after each IP header transformation such as TTL minus 1, and thereafter , obtain other business forwarding key information, directly replace and change the information of the data packet, without recalculating the required information or searching the fast forwarding entry table 124, so as to save system operation time and increase the forwarding speed;

Step S311, obtain the routing information recorded in the fast forwarding entry, perform NAT conversion, checksum update, etc., fast forward the data packet, and the process ends;

Step S312, performing common NAT translation;

Step S313, carry out other business forwarding, carry out route forwarding;

Step S314, recording the forwarding key information of the data packet, and generating a fast forwarding entry;

Step S315, search for the fast forwarding entry, if no entry is matched, then enter step S316; otherwise, the forwarding entry is matched, so the fast forwarding entry related to NAT conversion information and routing information inside can be extracted, and then enter step S319;

Step S316, performing ordinary NAT conversion on the data packet;

Step S317, carry out other business forwarding, carry out route forwarding;

Step S318, recording the forwarding key information of the data packet, and generating a fast forwarding entry, constructing a fast forwarding table 124;

Step S319, performing NAT fast conversion;

Step S320, obtain the converted private network IP address and port number in the fast NAT forwarding entry;

Step S321, replace and update the IP address and port, the checksum increment due to the change, this checksum increment includes the unified increment after each IP header transformation such as TTL minus 1, after that, obtain other services Forward key information, directly replace and change the information of the data packet, without recalculating the required information or searching the fast forwarding entry table 124, so as to save system operation time and increase the forwarding speed;

Step S322, obtain the routing information recorded in the fast forwarding entry, perform NAT conversion, checksum update, etc., and fast forward the data packet, and the flow process ends. the

As shown in Figure 4, the maintenance process of the fast NAT forwarding table is as follows:

Step S401, configure the aging time of the fast forwarding entry, if not configured, use the default value;

Step S401, receiving the data packet;

Step S402, extracting packet information: source address, destination address, source port number, destination port number and message protocol number, etc.;

Prepare for fast NAT forwarding;

Step S403, perform fast NAT forwarding entry matching, if hit, proceed to step S404, otherwise, proceed to step S405;

Step S404, increase the corresponding count, and place the forwarding entry at the end of the aging sequence. In addition, this entry can be placed at the head of the entry search conflict chain, so that subsequent packets with the same attributes can find the forwarding entry at the fastest speed , the process ends;

Step S405, judging whether the last use time of the first entry in the aging sequence exceeds the aging time. If the aging time has not been exceeded, it means that the current entry space cannot be released, so the NAT fast forwarding entry cannot be established, so proceed to step S405. S406, otherwise, the entry to be aged is updated according to the attributes of the new data packet, and step S404 is performed;

Step S406, the data packet is forwarded by ordinary NAT, the corresponding temporary structure is updated, and the process is ended;

Step S407, update the entries whose aging time has exceeded according to the forwarding key information of the new data packet, and place the newly updated or newly used entries at the end of the aging sequence, or at the head of the entry search conflict chain. the

Certainly, the present invention also can have other various embodiments, without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and deformations according to the present invention, but these Corresponding changes and deformations should belong to the scope of protection of the appended claims of the present invention. the

Claims (7)

1. the device that network address translation is transmitted is used to finish the forwarding of packet between public network and private network, and comprising: a general network address transition forwarding module is used for carrying out according to normal mode the forwarding of network address translation and packet; It is characterized in that, further comprise:

One fast network address transition forwarding module, be used to write down described packet and transmit needed forwarding key message, when receiving packet, extract the relevant information of described packet, search the quick forwarding entry that comprises described forwarding key message that is complementary with it, if do not find, then change by described general network address transition forwarding module and carry out the forwarding of general network address transition, if find, use forwarding key message in the described quick forwarding entry to upgrade relevant information in the described packet, and directly from described quick forwarding entry, obtain routing iinformation, transmit described packet;

Described fast network address transition forwarding module further comprises:

One quick forwarding information logging modle is used for the packet to the forwarding key message that does not have coupling, after described packet being carried out the forwarding of general network address transition, writes down the forwarding key message of described packet;

One quick forwarding information matching module, be used for after receiving described packet, extract the relevant information in the described packet, according to described relevant information as matching condition, search fast network address transition forwarding entry,, then transfer to described general network address transition forwarding module and handle if do not find, if found, it is that the forwarding of fast network address transition needs updated information that the forwarding entry that then finds promptly is positioned;

One forwarding module is used for obtaining described packet from described quick forwarding entry and transmits needed forwarding key message, and the relevant information in the described packet is replaced, and according to the routing index of preserving, directly obtains routing iinformation then, transmits described packet;

One quick forwarding entry table comprises one or more quick forwarding entrys, and the fast network address transition that is used to store described packet is transmitted needed forwarding key message;

Described quick forwarding entry table further comprises:

One quick forwarding information update module, be used for whole quick forwarding entrys is sorted according to the length that is not used the time, and configuration ageing time or employing default value, make regular check on the time that is not used of described quick forwarding entry, deletion surpasses the clauses and subclauses of ageing time, perhaps upgrade the clauses and subclauses that surpass ageing time, and the clauses and subclauses after will upgrading or the clauses and subclauses that newly match are positioned over the stem that the last and clauses and subclauses of aging order are searched the chain that conflicts with the forwarding key message of new data packets.

2. the device that network address translation according to claim 1 is transmitted is characterized in that described forwarding key message further comprises:

Source IP address, source port number, purpose IP address, destination slogan and message protocol type;

IP address, port numbers and routing iinformation after the network address translation;

Need the load sharing index that changes, tactful routing index and/or VLAN_ID in other business;

The IP address that network address translation produces and the change of port numbers;

The variation of life span and the verification that causes and the increment information of renewal.

3. the device that network address translation according to claim 2 is transmitted is characterized in that described quick forwarding entry table further comprises: the quick forwarding entry table of a private network to the quick forwarding entry table of public network and/or a public network to private network.

4. the device that network address translation according to claim 1 is transmitted is characterized in that described quick forwarding entry table is stored in internal memory or the cache memory.

5. the method that network address translation is transmitted is used to finish the forwarding of packet between public network and private network, it is characterized in that this method comprises:

Step 1 is received packet, extracts the networking information of address conversion in the described packet, is searching the quick forwarding entry of transmitting key message that comprises that is complementary with it in the forwarding entry table fast;

Step 2, if do not find, then carry out the forwarding of general network address transition, and in quick forwarding entry table the forwarding key message of the described packet of record, if found described quick forwarding entry, then use forwarding key message in the described quick forwarding entry to upgrade relevant information in the described packet, and directly from described quick forwarding entry, obtain routing iinformation, transmit described packet;

Described step 2 further comprises:

Step 101 if found the quick forwarding entry that is complementary, then is placed on described quick forwarding entry the last of aging order, and described quick forwarding entry is placed on clauses and subclauses searches first of the chain that conflicts;

Step 102, if do not find the quick forwarding entry that is complementary, then judge and whether surpass ageing time current last service time till now at the primary quick forwarding entry of aging order, if do not surpass ageing time, then described packet being carried out the general network address transition transmits, if surpassed ageing time, adopt the quick forwarding entry of the forwarding key message renewal of new data packets, and the quick forwarding entry after will upgrading is placed on the stem that aging last and clauses and subclauses are in proper order searched the chain that conflicts above ageing time.

6. the method that network address translation according to claim 5 is transmitted is characterized in that described step 1 further comprises:

Step 81, receive packet after, judge whether to carry out the fast network address transition and transmit;

Step 82, if not carrying out the fast network address transition transmits, then described packet is carried out general network address transition and routing forwarding, otherwise, extract source IP address, source port number, purpose IP address, destination slogan and the message protocol type of described packet, carry out the coupling of quick forwarding entry.

7. according to the method for claim 5 or 6 described network address translation forwardings, it is characterized in that described step 1 further comprises:

Judge the flow direction of described packet, if by private network to public network, then source IP address and port numbers are private network IP address and port numbers, purpose IP address and port numbers are the IP address and the port numbers of public network, begin to carry out the matched and searched of quick forwarding entry, if by public network during to private network, then source IP address and port numbers are public network IP address and port numbers, purpose IP address and port numbers are public network visible IP address and port numbers after the private network network address translation, carry out the matched and searched of quick forwarding entry.

Images