Patent ID: 7953007

Claim:
An excessive flow detection circuit comprising: an extraction circuit to which a packet or header information of the packet is inputted, which derives predetermined key information from the header information of the packet, and which derives packet length information contained in the header information or which measures a packet length of the packet, thereby to obtain packet length information of the packet; a representative value computation circuit which computes one or plurality of representative value from a plurality of predetermined values, on the basis of the key information derived by said extraction circuit; a table which has a plurality of entries respectively corresponding to the plurality of values, and in which each of the entries holds key information and a cumulative value of the packet lengths; a comparison circuit which compares the key information of the entry corresponding to the representative value computed by said representative value computation circuit and the key information derived by said extraction circuit, with reference to said table; an addition circuit which adds the packet length information obtained by said extraction circuit, to the cumulative value of the packet lengths in the pertinent entry, in a case where the key information items have agreed in said comparison circuit; and a threshold value comparison circuit which notifies excessive flow detection and/or outputs the key information corresponding to the cumulative value, in a case where the cumulative value of the packet lengths stored in said table has exceeded a preset threshold value, wherein when results of the comparisons between the key information of the entry and the key information derived by said extraction circuit disagree as to all the entries corresponding to the one or plurality of representative value computed, the entry whose cumulative value is a minimum in said table is specified, the key information derived by said extraction circuit is stored into the specified entry, and the packet length information obtained is written as the cumulative value of the specified entry anew.