Abstract: An improved method and system for generating a frame check sequence. A multiple-bit data string, M, is received in which M is of the form: anbncndnan−1bn−1cn−1dn−1 . . . a2b2c2d2a1b1c1d1. M is thereafter parsed into multiple subframes of the form: anan−1an−2 . . . a2a1; bnbn−1bn−2 . . . b2b1; cncn−1cn−2 . . . c2c1; and dndn−1dn−2 . . . d2d1. The subframes are padded with zeros resulting in subframes of the form: an000an−1000an−2000 . . . a2000a1000; 0bn000bn−1000bn−200 . . . 0b2000b100; 00cn000cn−1000cn−20 . . . 00c2000c100; and 000dn000dn−1000dn−2 . . . 000d2000d1. A partial check sum is then generated for each of the multiple subframes. Finally, each of the partial check sums are added together such that a frame check sequence for M is obtained.

Abstract: A method and apparatus for processing network frames using static and dynamic classifiers provides a flexible and modifiable frame classification system. Static and Dynamic classifiers are used in combination within a network processing system to provide the range capability and hardware assist capability of the static classifier, along with the incremental modifications possible with a dynamic classifier. The dynamic classifier is searched first for rules directing processing of a received frame. The static classifier is searched only if a dynamic classifier key for the frame is not found, or the dynamic key actions indicated that the static classifier should also be searched.

Abstract: A method and system for controlling pipes in a computer network is disclosed. The network includes processor(s) having a switch and a queue used for transmitting traffic through the switch. Minimum and maximum flows are set for each pipe. The queue level, any excess bandwidth and offered rate of packets are determined for the queue. A global transmit fraction is controlled using the queue level and offered rate so that the global transmit fraction and queue level are critically damped if the queue level is between certain levels. A transmit fraction for a flow is set to the minimum of the global and differential transmit fractions. The differential transmit fraction linearly increases the flow based on the minimum or maximum flow if excess bandwidth exists and the flow is less than the maximum and exponentially decreases the flow based on the minimum or maximum flow if excess bandwidth does not exist and the flow exceeds the minimum.

Abstract: A method and system for storing and searching for prefixes for rules, such as filter rules, in a computer system is disclosed. The method and system include providing a ternary content addressable memory (TCAM). The filter rules use range(s) of values in at least one dimension and correspond to prefix(es). The range(s) are described by prefix(es). Some filter rules may intersect. The method and system include providing priorities for the filter rules. The priorities include at least one different priority for the filter rules that intersect. The method and system also include storing the prefixes in the TCAM in block(s) in an order based upon the priorities of the filter rules. In another aspect, the method and system include searching the TCAM for a longest prefix match for a key and searching an additional storage for an almost exact match for the key in parallel with the TCAM.

Abstract: The decision within a packet processing device to transmit a newly arriving packet into a queue to await further processing or to discard the same packet is made by a flow control method and system. The flow control is updated with a constant period determined by storage and flow rate limits. The update includes comparing current queue occupancy to a threshold. The outcome of the update is adjustment up or down of the transmit probability value. The value is stored for the subsequent period of flow control and packets arriving during that period are subject to a transmit or discard decision that uses that value.

Abstract: The decision within a packet processing device to transmit a newly arriving packet into a queue to await processing or to discard the same packet is made by a flow control method and system. The flow control is updated with a constant period determined by storage and flow rate limits. The update includes comparing current queue occupancy to thresholds and also comparing present queue occupancy to previous queue occupancy. The outcome of the update is a new transmit probability value. The value is stored for the subsequent period of flow control and packets arriving during that period are subject to a transmit or discard decision that uses that value.

Abstract: A system for minimizing congestion in a communication system is disclosed. The system comprises at least one ingress system for providing data. The ingress system includes a first free queue and a first flow queue. The system also includes a first congestion adjustment module for receiving congestion indications from the free queue and the flow queue. The first congestion adjustment module generates end stores transmit probabilities and performs per packet flow control actions. The system further includes a switch fabric for receiving data from the ingress system and for providing a congestion indication to the ingress system. The system further includes at least one egress system for receiving the data from the switch fabric. The egress system includes a second free queue and a second flow queue. The system also includes a second congestion adjustment module for receiving congestion indications from the second free queue and the second flow queue.

Abstract: A method and system for controlling a plurality of pipes in a computer network is disclosed. The computer network includes at least one processor for a switch. The at least one processor has a queue. The plurality of pipes utilizes the queue for transmitting traffic through the switch. The method and system include allowing a minimum flow and a maximum flow to be set for each of the plurality of pipes and determining if excess bandwidth exists for the queue. The method and system also include linearly increasing a flow for a pipe of the plurality of pipes based on the minimum flow or the maximum flow if excess bandwidth exists and if the flow for the pipe of the plurality of pipes is less than the maximum flow for the pipe. The method and system also include exponentially decreasing the flow for the pipe of the plurality of pipes based on the minimum flow or the maximum flow if excess bandwidth does not exist and the flow is greater than the minimum flow for the pipe.

Abstract: A method and system for converting a plurality of ranges of values for a plurality of packet classification rules in a computer system is disclosed. The plurality of ranges exists in at least one dimension. The method and system include mapping each of the plurality of ranges to a plurality of nonoverlapping prefixes. The method and system also include mapping the plurality of nonoverlapping prefixes to a plurality of overlapping prefixes corresponding to the plurality of ranges.

Abstract: A structure and technique for preventing collisions using a hash table in conjunction with a CAM to identify and prevent a collisions of binary keys. A portion of the hash value of a binary key, which does not collide with a portion of the hash value of any other reference binary key, is used as an entry in the hash table. If two or more binary keys have identical values of the portions of the hash values, each of these binary keys are stored in their entirety, in the CAM. The key in the CAM provides a pointer to a data structure where the action associated with that binary key is stored. If the binary key is not found in the CAM, the binary key is hashed, and a specific entry in the hash table is selected using a portion of this hash value.

Abstract: A method, system and computer program product for detecting conditions of network instability. An attribute indicative of network instability, e.g., processor and/or co-processor utilization, packet arrival rates, packet peak rates, packet size distribution, packet clustering tendencies, buffer usage patterns, occurrence of peak utilization, out-of-buffer conditions, packet discard rates, may be monitored for a network device, e.g., router. The monitored attribute may be associated with a plurality of labels (variables) where a portion of those labels may be stored in a cache. A hit ratio for the cache storing labels associated with the monitored attribute may be tracked within a period of time based on the number of requested items, i.e., labels, that are currently stored in the cache. A condition of network instability may then be detected based on the hit ratio by determining if the absolute value of the acceleration of the hit ratio exceeds a threshold.

Abstract: A method, system and computer program product for detecting denial-of-service attacks. The randomness in the Internet Protocol (IP) source addresses of transmitted IP packets may be detected by performing a hash function on the IP source addresses thereby generating one or more different hash values. If a high number of different hash values were generated for a small number of IP packets evaluated, then random IP source addresses may be detected. By detecting random source IP addresses, a denial-of-service attack may be detected.

Abstract: A method, system and computer program product for detecting the dissemination of malicious programs. The degree of randomness in the Internet Protocol (IP) destination addresses of received IP packets to be forwarded to an external network may be detected by performing a hash function on the IP destination addresses thereby generating one or more different hash values. If a high number of different hash values were generated for a small number of IP packets examined, then random IP destination addresses may be detected. By detecting random destination IP addresses, the dissemination of a malicious program, e.g., virus, worm program, may be detected.

Abstract: A method and system for selecting a direct table and a plurality of corresponding trees in a computer system is disclosed. The method and system include selecting a plurality of widths for the direct table and probabilistically determining at least one desired property of the direct table and the plurality of corresponding trees for the plurality of widths. The method and system also include selecting a width of the plurality of widths for the direct table and the plurality of corresponding trees based on the at least one desired property of the direct table and the plurality of corresponding trees.

Abstract: A method and system within a telecommunications network for allocating available bandwidth among a plurality of sessions that share a common data link. First, a repeating unit time interval is designated for conducting the plurality of sessions. Next, the input flow rate from the source node of each of the sessions into the common data link is monitored. Thereafter, a target flow rate is computed and assigned to each of the sessions. The sum of the target flow rates is equal to the available bandwidth of the common data link. Finally, for each of the sessions in which the monitored input flow rate exceeds the assigned target flow rate, the source node is dynamically paused during each repeating unit time interval, such that the monitored input flow rate conforms to the assigned target flow rate for each of the sessions.

Abstract: A method and system for transmitting packets in a packet switching network. Packets received by a packet processor may be prioritized based on the urgency to process them. Packets that are urgent to be processed may be referred to as real-time packets. Packets that are not urgent to be processed may be referred to as non-real-time packets. Real-time packets have a higher priority to be processed than non-real-time packets. A real-time packet may either be discarded or transmitted into a real-time queue based upon its value priority, the minimum and maximum rates for that value priority and the current real-time queue congestion conditions. A non-real-time packet may either be discarded or transmitted into a non-real-time queue based upon its value priority, the minimum and maximum rates for that value priority and the current real-time and non-real-time queue congestion conditions.

Abstract: A method and system for controlling a plurality of pipes in a computer network, including at least one processor for a switch, the at least one processor having a queue, the plurality of pipes utilizing the queue for transmitting traffic through the switch, wherein each pipe is assigned a priority ranking class, each class has a unique priority rank with respect to each of the other classes, the ranks ranging from a highest priority rank to a lowest priority rank. A transmission probability is calculated for each pipe responsive to its priority rank. If excess bandwidth exists for the queue, the transmission probability of each pipe is linearly increased. Alternatively, if excess bandwidth does not exist, the transmission probability for each pipe is exponentially decreased. Packets are transferred from a pipe to the queue responsive to the pipe transmission probability and priority rank.

Abstract: A method and system for testing a plurality of filter rules in a computer system is disclosed. The plurality of filter rules uses at least one range of values in at least one dimension. Each range includes a minimum and a maximum value. The filter rules are used with a key. The method and system include reducing an amount of testing required based on the minimum and maximum value of each range to ensure that the key can match a portion of the filter rules and testing the key against the portion of the filter rules. In one aspect, the method and system include determining at least one subset of filter rules and testing the key against each subset to determine whether the key matches a filter rule of a subset. The subset of filter rules is non-intersecting in at least a second dimension and is based on the minimum value and the maximum value of each range in the second dimension.

Abstract: A method and system for testing a plurality of filter rules in a computer system is disclosed. The plurality of filter rules are used with a key that is capable of matching at least one of the plurality of filter rules. The at least one filter rule corresponds to at least one action. The computer system has a cache including a plurality of bins and a decision tree. The method and system include searching a plurality of stored keys in the cache for the key. Preferably, this search of the cache for the key includes determining whether a stored key exactly matches the key. A plurality of stored filter rules corresponds to the plurality of stored keys. A plurality of stored actions corresponds to the plurality of stored filter rules. The cache stores each of the plurality of stored keys and at least one stored action in each bin of a portion of the bins.

Abstract: The decision at network interface with an edge resource such as server to allow or not allow an new connection request is made by a connection control mechanism.