Abstract: In one embodiment, an apparatus includes a processor and logic integrated with and/or executable by the processor. The logic is configured to communicate with a first physical switch, a second physical switch, and an overlay network that connects the first physical switch to the second physical switch. The logic is also configured to receive a request for a communication path through the overlay network for a packet, the request including at least the packet, first information about a source of the packet, the source of the packet being connected to the first physical switch, and second information about a most closely connected physical switch to a destination of the packet. Moreover, the logic is configured to determine the destination of the packet, the destination of the packet being connected to the second physical switch. Also, the logic is configured to determine whether to apply a security policy to the packet.

Abstract: Inter-tenant and inter-openflow island software communicate in SDN networks by: (i) providing a software defined networking (SDN) network including a plurality of Openflow islands, a first tenant and a second tenant; and (ii) communicating, from the first tenant over the SDN network to the second tenant, a first communication. The first communication passes through at least two Openflow islands of the plurality of Openflow islands as the first communication is communicated through the SDN network from the first tenant to the second tenant.

Abstract: In one embodiment, a system includes a network having a plurality of switches and one or more devices connected to one or more of the plurality of switches, a software defined network (SDN) controller connected to one or more of the plurality of switches in the network, the SDN controller having logic integrated with and/or executable by a processor, the logic being adapted to determine SDN routes through the network between the one or more devices and each of the plurality of switches and send one or more SDN routes to each switch in the network capable of communicating with the SDN controller. In other embodiments, methods and computer program products are also described for providing SDN routes through a network.

Abstract: In one embodiment, a method for applying security policy in an overlay network includes receiving a request, including a packet, for a communication path through an overlay network, determining whether a security policy is to be applied to the packet based on at least one of: contents of the packet, first information, and second information, selecting a communication path between a source physical switch and a destination physical switch, wherein the selected communication path directly connects the source physical switch to the destination physical switch when it is determined to not apply the security policy to the packet, and the selected communication path connects the source physical switch to the destination physical switch via a security appliance when it is determined to apply the security policy to the packet, and sending the selected communication path to the source physical switch.

Abstract: In one embodiment, a system includes a hardware processor and logic integrated with and/or executable by the processor, the logic being configured to receive an overlay packet, determine at least one characteristic of the overlay packet and/or inner packets of the overlay packet in order to classify the overlay packet into a classification, associate a flow identifier to the overlay packet, determine one or more policies to associate with the flow identifier, where the one or more policies are based on the at least one characteristic of the overlay packet and/or the inner packets of the overlay packet, and store the flow identifier in a header of the overlay packet, where the flow identifier is a string of characters of a predetermined length, the flow identifier being unique from all other flow identifiers in a particular overlay network and associated with an identified flow of the overlay packet.

Abstract: In one embodiment, a system for classifying traffic in an overlay network includes a processor adapted for executing logic, logic adapted for receiving an overlay packet, logic adapted for determining at least one characteristic of the overlay packet and/or one or more inner packets of the overlay packet in order to classify the overlay packet, logic adapted for associating a flow identifier to the overlay packet, logic adapted for determining one or more policies to associate with the flow identifier, wherein the one or more policies are based on the at least one characteristic of the overlay packet and/or the one or more inner packets of the overlay packet, and logic adapted for storing the flow identifier in a header of the overlay packet. More systems, methods, and computer program products for classifying traffic in an overlay network are presented in accordance with other embodiments.

Abstract: A switch for a switching network includes a plurality of ports for communicating data traffic and a switch controller that controls switching between the plurality of ports. The switch controller selects a forwarding path for the data traffic based on at least topological congestion information for the switching network. In a preferred embodiment, the topological congestion information includes sFlow topological congestion information and the switch controller includes an sFlow client that receives the sFlow topological congestion information from an sFlow controller in the switching network.

Abstract: According to one embodiment, a system includes a switch controller in communication with a plurality of switches in a switch cluster via a communication protocol, at least one switch in the switch cluster being configured to connect to a host, wherein the switch controller is configured to: maintain a Layer-3 (L3) host table configured to store entries including address information for hosts connected directly to the switch cluster, apply a policy to all existing entries in the L3 host table, and remove one or more existing entries according to the policy in order to reduce a number of entries in the L3 host table. In other embodiments, systems, computer program products, and methods for managing a L3 host table in software defined network (SDN)-based switch clusters having L3 distributed router functionality are presented.

Abstract: A communication protocol in a layer two (L2) network switch comprises, in response to a service request by a source node, registering the source node for packet communication service. The protocol further comprises forwarding one or more packets from the registered source node to one or more destination nodes. The protocol further comprises receiving packets from one or more destination nodes and forwarding each received packet to a corresponding registered node.

Abstract: According to one embodiment, Layer-3 (L3) distributed router functionality is provided to a switch cluster by receiving an address resolution protocol (ARP) request packet from a first host at an entry switch in a switch cluster, a switch controller being in communication with the entry switch, and the ARP request packet including a virtual router IP address of the switch controller as a target, forwarding the ARP request packet to the switch controller after adding a header that adheres to a communication protocol used by the switch controller, receiving an ARP response packet from the switch controller indicating: a source IP address corresponding to a virtual router of the switch controller and a SMAC corresponding to the switch controller, forwarding the ARP response packet to the first host after stripping the communication protocol header, and setting the virtual router as a default gateway for traffic received from the first host.

Abstract: Each of first and second bridges of a data network having respective external links to an external node implement a network bridge component that forwards traffic inside the network and a virtual bridge component that forwards traffic outside of the network. A virtual bridge is formed including the virtual bridge components of the first and second bridges and an interswitch link (ISL) between the virtual bridge components of the first and second bridges. Data frames are redirected via the ISL in response to a link-down condition of one of the external links.

Abstract: Each of first and second bridges of a data network having respective external links to an external node implement a network bridge component that forwards traffic inside the network and a virtual bridge component that forwards traffic outside of the network. A virtual bridge is formed including the virtual bridge components of the first and second bridges and an interswitch link (ISL) between the virtual bridge components of the first and second bridges. Data frames are redirected via the ISL in response to a link-down condition of one of the external links.

Abstract: A switching network includes first, second and third switches coupled for communication, such that the first and third switches communicate data traffic via the second switch. The first switch is operable to request transmission credits from the third switch, receive the transmission credits from the third switch and perform transmission of data traffic in reference to the transmission credits. The third switch is operable to receive the request for transmission credits from the first switch, generate the transmission credits and transmit the transmission credits to the first switch via the second switch. The second switch is operable to modify the transmission credits transmitted by the third switch prior to receipt of the transmission credits at the first switch.

Abstract: In one embodiment, a method for providing link aggregation (LAG) to heterogeneous switches includes receiving, at a switch controller, LAG requests forwarded by switches and determining that multiple LAG requests corresponding to a server have been received, grouping the multiple LAG requests into LAG groups according to a switch from which they were received and correlating all the LAG groups with the server, instructing each of the switches to setup a LAG group with the server according to the LAG groups determined by the switch controller, and creating alternate flows that correspond to flows through each of the switches to the server through direction from the switch controller. The switches may rely upon OpenFlow to communicate with the switch controller, in some approaches. In addition, other methods for providing LAG to heterogeneous switches are also described, along with systems and computer program products which provide LAG to heterogeneous switches.

Abstract: A distributed device architecture includes a master device and one or more member devices. A simple network management protocol (SNMP) agent of a master device receives an SNMP request from a managing device. Where the SNMP request pertains to a given member device, and where the SNMP request requires involvement of the given member device to fulfill the SNMP request, the master device generates a non-SNMP request corresponding to the SNMP request and transmits the non-SNMP request to the given member device. A non-SNMP agent of the given member device processes the non-SNMP request and transmits processing results back to the master device. The master device generates an SNMP response corresponding to the processing results, and the SNMP agent of the master device transmits the SNMP response back to the managing device.

Abstract: A technique for executing normally interruptible threads of a process in a non-preemptive manner includes in response to a first entry associated with a first message for a first thread reaching a head of a run queue, receiving, by the first thread, a first wake-up signal. In response to receiving the wake-up signal, the first thread waits for a global lock. In response to the first thread receiving the global lock, the first thread retrieves the first message from an associated message queue and processes the retrieved first message. In response to completing the processing of the first message, the first thread transmits a second wake-up signal to a second thread whose associated entry is next in the run queue. Finally, following the transmitting of the second wake-up signal the first thread releases the global lock.

Abstract: A switching network includes an upper tier including a master switch and a lower tier including a plurality of lower tier entities. The master switch includes a plurality of ports each coupled to a respective one of the plurality of lower tier entities. Each of the plurality of ports includes a plurality of virtual ports each corresponding to a respective one of a plurality of remote physical interfaces (RPIs) at the lower tier entity coupled to that port. Each of the plurality of ports also includes a receive interface that, responsive to receipt of data traffic from a particular lower tier entity among the plurality of lower tier entities, queues the data traffic to the virtual port among the plurality of virtual ports that corresponds to the RPI on the particular lower tier entity that was the source of the data traffic.

Abstract: Packet processing logic of a host system's virtualization manager detects packets on the ingress or the egress path to/from a virtual port having three bitmap arrays for processing packets within a virtual local area network (VLAN). The logic checks the VLAN identifier (VID) of the packet to determine, based on an offset position within the corresponding bitmap array, whether the port supports the VLAN. Both the ingress array offset position and egress array offset positions correspond to the value of the VID, and are set within the specific bitmap array during configuration of the VLAN on the port. When the VLAN is supported by the port, the logic enables the packet to be processed by the port. Otherwise, the logic discards the packet. A strip bitmap array indicates when a packet's VID should be removed prior to forwarding the packet on the egress of a port (or destination port).

Abstract: A distributed device architecture includes a master device and one or more member devices. A simple network management protocol (SNMP) agent of a master device receives an SNMP request from a managing device. Where the SNMP request pertains to a given member device, and where the SNMP request requires involvement of the given member device to fulfill the SNMP request, the master device generates a non-SNMP request corresponding to the SNMP request and transmits the non-SNMP request to the given member device. A non-SNMP agent of the given member device processes the non-SNMP request and transmits processing results back to the master device. The master device generates an SNMP response corresponding to the processing results, and the SNMP agent of the master device transmits the SNMP response back to the managing device.

Abstract: A switching network includes an upper tier including a master switch and a lower tier including a plurality of lower tier entities. The master switch includes a plurality of ports each coupled to a respective one of the plurality of lower tier entities. Each port includes a plurality of virtual ports each corresponding to a respective one of a plurality of remote physical interfaces (RPIs) at the lower tier entity coupled to that port. Each port also includes a receive interface that, responsive to data traffic from a particular lower tier entity, queues the data traffic to the virtual port that corresponds to the RPI on the particular lower tier entity that was the source of the data traffic. The master switch further includes a switch controller that switches data traffic from the virtual port to an egress port from which the data traffic is forwarded.