Abstract: A method and system for providing a hash and a complement of the hash for an item in a computer system are disclosed. The method and system include providing a plurality of components from the item. The plurality of components include a first component and a last component. Each of the plurality of components includes a particular number of bits. The method and system also include cascading the plurality of components through at least one XOR to provide a plurality of resultants. The plurality of resultants includes a first resultant and a final resultant. The final resultant includes only the last component. The first resultant includes an XOR of the first component and remaining cascaded components of the plurality of components. The method and system also include applying an invertible hash function and an invertible hash function complement to at least the first resultant to provide the hash. The complement of the hash includes the plurality of resultants except the first resultant.

Abstract: A method and system for finding a longest prefix match for a key in a computer network is disclosed. The method and system include providing a main engine and providing an auxiliary engine. The main engine is for storing a first plurality of addresses and for searching the first plurality of addresses for the longest prefix match for the key. None of the first plurality of addresses is a prefix for another address of the first plurality of addresses. The auxiliary engine is for storing and searching a second plurality of addresses. A first address of the second plurality of addresses is capable of including the prefix for a second address of the first plurality of addresses or for a third address for the second plurality of addresses. None of the first plurality of addresses is the prefix for any of the second plurality of addresses. Each of the second plurality of addresses is distinct from each of the first plurality of addresses.

Abstract: A method, system and computer program product for detecting conditions of network instability. An attribute indicative of network instability, e.g., processor and/or co-processor utilization, packet arrival rates, packet peak rates, packet size distribution, packet clustering tendencies, buffer usage patterns, occurrence of peak utilization, out-of-buffer conditions, packet discard rates, may be monitored for a network device, e.g., router. The monitored attribute may be associated with a plurality of labels (variables) where a portion of those labels may be stored in a cache. A hit ratio for the cache storing labels associated with the monitored attribute may be tracked within a period of time based on the number of requested items, i.e., labels, that are currently stored in the cache. A condition of network instability may then be detected based on the hit ratio by determining if the absolute value of the acceleration of the hit ratio exceeds a threshold.

Abstract: A method and system for storing a plurality of filter rules in a computer system is disclosed. The plurality of filter rules uses at least one range of values in at least one dimension. The method and system include separating a portion of the plurality of filter rules into a plurality of pure subsets of filter rules. Each of the plurality of pure subsets of filter rules includes at least one of the plurality of filter rules. The method and system also include combining a portion of the plurality of pure subsets of filter rules to provide a combined subset and determining whether an efficiency of utilizing the plurality of filter rules is improved by combining the portion of the plurality of pure subsets of filter rules. The method and system further includes storing the plurality of filter rules including storing the portion of the plurality of subsets of filter rules as the combined subset if the efficiency of searching the plurality of filter rules is improved.

Abstract: A remote controller is coupled to a target system via a computer network A real time probe is installed in software executing on a target system, typically a Digital Signal Processor (DSP). The remote controller includes a “debugger user interface” which accepts and interprets scoping commands issued by a developer. A controller network driver constructs appropriate network packets to be sent over the network to the target system. The target system has a control processor which runs a target network driver for receiving the network packets containing the scoping commands. The scoping commands are sent to an “embedded debugger” which performs the requested probing/scoping. When the DSP code runs across an address where the probe is installed, the embedded debugger will collect the signal values. The collected scope data will be interleaved and sent to the target network driver which, will encapsulate the information into suitable packets to send back to the controller via the network.

Abstract: A method and system for storing and searching for prefixes for rules, such as filter rules, in a computer system is disclosed. The method and system include providing a ternary content addressable memory (TCAM). The filter rules use range(s) of values in at least one dimension and correspond to prefix(es). The range(s) are described by prefix(es). Some filter rules may intersect. The method and system include providing priorities for the filter rules. The priorities include at least one different priority for the filter rules that intersect. The method and system also include storing the prefixes in the TCAM in block(s) in an order based upon the priorities of the filter rules. In another aspect, the method and system include searching the TCAM for a longest prefix match for a key and searching an additional storage for an almost exact match for the key in parallel with the TCAM.

Abstract: The decision to discard or forward a packet is made by a flow control mechanism, upstream from the forwarding engine in the node of a communication network. The forwarding engine includes a switch with mechanism to detect congestion in the switch and return a binary signal B indicating congestion or no congestion. The flow control mechanism uses B and other network related information to generate a probability transmission table against which received packets are tested to determine proactively whether a packet is to be discarded or forwarded.

Abstract: A method of progressive response for invoking and suspending blocking measures that defend against network anomalies such as malicious network traffic so that false positives and false negatives are minimized. When an anomaly is detected, the detector notifies protective equipment such as a firewall or a router to invoke a blocking measure. The blocking measure is maintained for an initial duration, after which it is suspended while another test for the anomaly is made. If the anomaly is no longer evident, the method returns to the state of readiness. Otherwise, a loop is executed to re-applying the blocking measure for a specified duration, then suspend the blocking measure and test again for the anomaly. If the anomaly is detected, the blocking measure is re-applied, and its duration is adapted. If the anomaly is no longer detected, the method returns to the state of readiness.

Abstract: A packet network redistributes excess bandwidth for voice and data sessions applying a Quality of Service (QoS) algorithm. The network includes interacting client stations using H.323 protocol managing bit rate according to an algorithm as voice and data sessions are added or removed from the network. The client stations include codecs coupled to the network. The codecs provide voice sessions at a minimum bandwidth using a voice codec bit rate and preferred bandwidth using another voice codec bit rate. A first algorithm applies the QoS algorithm allocating bandwidth between interacting client stations after the addition of a new voice or data session when there is insufficient bandwidth for the new session to receive preferred bandwidth. A second algorithm is applied when a voice or data session is removed from the interacting client stations. If any session is allocated minimum bandwidth the QoS increases a voice session at minimum bandwidth to preferred bandwidth if excess bandwidth is available.

Abstract: A method and system for encoding a set of range labels for each parameter field in a packet classification key in such a way as to require preferably only a single entry per rule in a final processing stage of a packet classifier. Multiple rules are sorted accorded to their respective significance. A range, based on a parameter in the packet header, is previously determined. Multiple rules are evaluated according to an overlapping of rules according to different ranges. Upon a determination that two or more rules overlap, each overlapping rule is expanded into multiple unique segments that identify unique range intersections. Each cluster of overlapping ranges is then offset so that at least one bit in a range for the rule remains unchanged. The range segments are then converted from binary to Gray code, which results in the ability to determine a CAM entry to use for each range.

Abstract: A method and system for graphically representing relationships between a plurality of filter rules in a computer system is disclosed. The computer system includes a display. Each of the plurality of filter rules has a priority. The method and system include allowing entry of at least one filter rule of the plurality of filter rules and providing a graphical display of a first portion of the plurality of filter rules on the display. Each of the first portion of the plurality of filter rules is displayed hierarchically based on the priority of each of the first portion of the plurality of filter rules.

Abstract: A method and system for finding a longest matching prefix for an input keyword from among multiple prefixes. The prefixes are data strings of varying lengths wherein prefixes of length n or greater are probabilistically a longest prefix match. The method of the present invention begins by mapping the prefixes of length greater than or equal to n1, that is, in the interval [n1, L], into a first lookup system. Remaining prefixes of length less than n1 but greater than or equal to n2, that is, in the interval [n2, n1−1], are mapped into a second index utilizing a second hash function, wherein n2 is less than n1. Further lookup systems on prefixes having lengths in the intervals [n3, n2−1], [n4, n3−1], and so on, may also be utilized, as determined by optimization studies and the statistics of routing tables.

Abstract: Methods systems and computer program products are provided for hashing address values that exhibit banding in a plurality of regions of an address space defined by at least two segments of the address values, by performing at least one of a translation and a rotation of the at least two segments to thereby map the at least two segments from the plurality of regions to one of the plurality of regions.

Abstract: A network switch as well as methods, systems and computer program products for controlling congestion at a granularity of less than a link are provided. Such finer granularity may be provided by pausing traffic at a source port level of a network switch. The network switch which transmitted a message which resulted in congestion being detected is notified of the congestion and pauses the communications from the source port of the message while maintaining communications over the link from other source ports. Such source port level congestion control may be provided by a network switch having a sub-queue of its output queues where each sub-queue corresponds to an input port. Source port level pausing of transmissions may then be provided by pausing the sub-queue associated with a source port.

Abstract: A method and system for controlling a flow of a plurality of packets in a computer network is disclosed. The computer network includes a queue. The method and system include determining a queue level for the queue and determining an offered rate of the plurality of packets to the queue. The method and system also include controlling a transmission fraction of the plurality of packets to the queue, based on the queue level, the offered rate and a previous value of the transmission fraction so that the transmission fraction and the queue level are critically damped if the queue level is between at least a first queue level and a second queue level.

Abstract: A method and system are disclosed for allocating data input bandwidth from a source link to a plurality of N data queues each having a variable occupancy value, Qi(t), and a constant decrement rate, Di, where i designated the ith queue among the N queues. First, a threshold occupancy value, T, is designated for the N queues. During each time step of a repeating time interval, &Dgr;t, the occupancy value, Qi, is compared with T. In response to each and every of said N data queues having occupancy values exceeding T, pausing data transmission from the source link to the N data queues, such that overflow within the data queues is minimized. In response to at least one of the N data queues having an occupancy value less than or equal to T, selecting one among the N data queues to be incremented, and incrementing the selected data queue, such that underflow of the selected queue is minimized. In the context of scheduling one cell per time step, the value of T is one.

Abstract: A method and system for controlling a flow of a plurality of packets in a computer network is disclosed. The network includes a queue having a maximum queue level that is possible. The method and system include determining a queue level for the queue and determining an offered rate of the plurality of packets to the queue. The method and system also include determining a virtual maximum queue level based on the queue level and the maximum queue level and controlling a transmission fraction of the plurality of packets to the queue, based on the queue level, the offered rate and the virtual maximum queue level.

Abstract: A system and method for retrieving information in a distributed table by partitioning a search key. A packet processor may generate a search key for a received packet of data. The packet processor may partition the search key into a plurality of segments where the length of each segment corresponds to a size of a particular layer of a table. The packet processor may read a particular entry in a particular layer, e.g., the first layer, of the table using a value of the segment, e.g., the first segment, associated with that layer. A determination may be made to determine if the particular entry read stores a pointer that points to the next level of the table. If so, then the packet processor may read a particular entry in the next level of the table using the value of the next segment of the plurality of segments.

Abstract: A method for dynamically adjusting the flow rate of a plurality of logical pipes that share a common output queue. In accordance with the method of the present invention, a minimum flow rate and a maximum flow rate are set for each of the pipes. Next a determination is made of whether or not excess queue bandwidth exists in accordance with the output flow rate of the shared queue. The determination of whether or not excess bandwidth exists comprises comparing the output flow rate of the shared queue with a pre-determined threshold queue output value. An instantaneous excess bandwidth signal has a value of 1 if there is excess bandwidth and is otherwise 0 if there is no excess bandwidth. In an alternate embodiment, the instantaneous excess bandwidth signal for a particular pipe is logically ANDed with one or more additional excess bandwidth signals to form a composite instantaneous excess bandwidth signal.

Abstract: A method and system for storing a plurality of filter rules in a computer system is disclosed. The plurality of filter rules uses at least one range of values in at least one dimension. The method and system include separating a portion of the plurality of filter rules into a plurality of pure subsets of filter rules. Each of the plurality of pure subsets of filter rules includes at least one of the plurality of filter rules. The method and system also include combining a portion of the plurality of pure subsets of filter rules to provide a combined subset and determining whether an efficiency of utilizing the plurality of filter rules is improved by combining the portion of the plurality of pure subsets of filter rules. The method and system further includes storing the plurality of filter rules including storing the portion of the plurality of subsets of filter rules as the combined subset if the efficiency of searching the plurality of filter rules is improved.