Abstract: The present disclosure provides a method and apparatus for determining an application service dependency, and a processor. The method includes that: an input pulse of first application service and an output pulse of second application service are acquired; a time interval between the input pulse and the output pulse is determined; and an application service dependency between the first application service and the second application service is determined based on the time interval. According to the present disclosure, a technical problem that an application service dependency between different pieces of application service cannot be determined accurately through a method for determining an application service dependency provided in the related art is solved.

Abstract: A method for processing network data traffic includes obtaining a first distributed structure corresponding to a program based on a first storage structure, wherein the program is configured to process network data traffic; dividing a network device based on a second storage structure into a plurality of execution units, wherein the plurality of execution units is configured to execute the program; mapping the first distributed structure and the plurality of execution units to obtain a second distributed structure; and controlling the plurality of execution units to process network data traffic based on the second distributed structure.

Abstract: A data center system includes: at least two data center subsystems interconnected through a layer-2 network, each of the data center subsystems comprising a plurality of hosts, a plurality of layer-2 switches connected with the plurality of hosts, a firewall group connected with the layer-2 switches, and a layer-2 extension device connected with the layer-2 switches; wherein the firewall groups of the at least two data center subsystems are configured to transmit synchronization information to each other through a synchronization channel in a first virtual local area network; wherein the layer-2 extension devices of the at least two data center subsystems are configured to transmit service information through a service channel in a second virtual local area network; and wherein the first virtual local area network and the second virtual local area network are implemented in the layer-2 network.

Abstract: A method for processing network data traffic includes obtaining a first distributed structure corresponding to a program based on a first storage structure, wherein the program is configured to process network data traffic; dividing a network device based on a second storage structure into a plurality of execution units, wherein the plurality of execution units is configured to execute the program; mapping the first distributed structure and the plurality of execution units to obtain a second distributed structure; and controlling the plurality of execution units to process network data traffic based on the second distributed structure.

Abstract: A processing system includes: a first service machine having a first service module; and a first service switch; wherein the first service machine and the first service switch are configured for logically coupling between virtual machines and a virtual switch; wherein the first service machine comprises a first communication interface and a second communication interface, the second communication interface configured for communication with the first service switch.

Abstract: A processing system includes: a first service machine having a first service module; and a first service switch; wherein the first service machine and the first service switch are configured for logically coupling between virtual machines and a virtual switch; wherein the first service machine comprises a first communication interface and a second communication interface, the second communication interface configured for communication with the first service switch.

Abstract: A device receives traffic; identifies an address associated with the traffic; determines whether the address is associated with an aggregate interface, the aggregate interface being associated with a first port and a second port. The first port corresponds to a first node in a first state, that indicates that the first node is available to forward the traffic, and the second port corresponds to a second node in a second state, that indicates that that the second node is not available to forward the traffic. The device transmits the traffic to the first node via the first port and to the second node, via the second port, when the address is associated with the aggregate interface. Transmitting the traffic enables the second node to forward the traffic when the first node changes from the first state to the second state.

Abstract: A device receives traffic; identifies an address associated with the traffic; determines whether the address is associated with an aggregate interface, the aggregate interface being associated with a first port and a second port. The first port corresponds to a first node in a first state, that indicates that the first node is available to forward the traffic, and the second port corresponds to a second node in a second state, that indicates that that the second node is not available to forward the traffic. The device transmits the traffic to the first node via the first port and to the second node, via the second port, when the address is associated with the aggregate interface. Transmitting the traffic enables the second node to forward the traffic when the first node changes from the first state to the second state.

Abstract: A data center system includes: at least two data center subsystems interconnected through a layer-2 network, each of the data center subsystems comprising a plurality of hosts, a plurality of layer-2 switches connected with the plurality of hosts, a firewall group connected with the layer-2 switches, and a layer-2 extension device connected with the layer-2 switches; wherein the firewall groups of the at least two data center subsystems are configured to transmit synchronization information to each other through a synchronization channel in a first virtual local area network; wherein the layer-2 extension devices of the at least two data center subsystems are configured to transmit service information through a service channel in a second virtual local area network; and wherein the first virtual local area network and the second virtual local area network are implemented in the layer-2 network.

Abstract: A processing system includes: a first service machine having a first service module; and a first service switch; wherein the first service machine and the first service switch are configured for logically coupling between virtual machines and a virtual switch; wherein the first service machine comprises a first communication interface and a second communication interface, the second communication interface configured for communication with the first service switch.

Abstract: A method performed by a network appliance having a plurality of application processing units, includes: receiving a first packet at the network appliance; calculating a first value using a mathematical algorithm based on one or more information regarding the first packet; and using the calculated first value to identify a first application processing unit of the plurality of application processing units in the network appliance. A network appliance includes: a plurality of processing units that are communicatively connected to each other; wherein a first processing unit of the plurality of processing units is configured for: calculating a first value using a mathematical algorithm based on one or more information regarding a first packet; and using the calculated first value to identify a second processing unit of the plurality of processing units.

Abstract: A method performed by a network system having a plurality of processing units implemented using a plurality of respective virtual machines, includes: receiving a first packet at a first virtual machine of the plurality of virtual machines, wherein the first virtual machine is configured to receive the first packet from a network through an interface and has session processing capability; calculating a first value using a mathematical algorithm based on one or more information regarding the first packet; and using the calculated first value to identify a second virtual machine of the plurality of virtual machines in the network system.

Abstract: In general, techniques are described for performing decentralized packet dispatch. A network device comprising one or more service processing units (SPUs) and an interface may implement the techniques. The interface receives a packet associated with a session and selects a first one of SPUs to dispatch the packet based on first information extracted from the packet. The first one of the SPUs dispatches the packet to a second one of the SPUs based on second information extracted from the packet. The second one of the SPUs performs first pass processing to configure the network security device to perform fast path processing of the packet such that second one of the SPUs applies one or more services to the packet and subsequent packets associated with the same session without application of services to the packets by the first one of the service processing units.

Abstract: A device receives traffic; identifies an address associated with the traffic; determines whether the address is associated with an aggregate interface, the aggregate interface being associated with a first port and a second port. The first port corresponds to a first node in a first state, that indicates that the first node is available to forward the traffic, and the second port corresponds to a second node in a second state, that indicates that that the second node is not available to forward the traffic. The device transmits the traffic to the first node via the first port and to the second node, via the second port, when the address is associated with the aggregate interface. Transmitting the traffic enables the second node to forward the traffic when the first node changes from the first state to the second state.

Abstract: A device receives traffic; identifies an address associated with the traffic; determines whether the address is associated with an aggregate interface, the aggregate interface being associated with a first port and a second port. The first port corresponds to a first node in a first state, that indicates that the first node is available to forward the traffic, and the second port corresponds to a second node in a second state, that indicates that that the second node is not available to forward the traffic. The device transmits the traffic to the first node via the first port and to the second node, via the second port, when the address is associated with the aggregate interface. Transmitting the traffic enables the second node to forward the traffic when the first node changes from the first state to the second state.

Abstract: This disclosure is directed toward an integrated switching and routing security device that provides zone-based security directly between layer two (L2) interfaces of L2 bridge domains and/or layer three (L3) interfaces of L3 routing instances within the security device. The integrated switching and routing security device supports both switching and routing functionalities for packets on L2 and L3 interfaces, and supports security within and between L2 bridge domains and L3 routing instances. The integrated switching and routing security device configures L2 security zones for one or more L2 interfaces and configures L3 security zones for one or more L3 interfaces. The integrated switching and routing security device then applies security policies to incoming packets according to the L2 security zones and/or the L3 security zones associated with the incoming interface and an outgoing interface for the packets to provide end-to-end security within the security device.

Abstract: In general, techniques are for providing a direct forwarding path between virtual routers within a single virtualized routing system. In one example, a method includes combining forwarding information from a plurality of virtual routers into collapsed forwarding information that comprises one or more direct forwarding paths between the respective virtual routers. The method also includes determining a direct forwarding path to an egress interface of the second virtual router, in response to receiving a network packet at an ingress interface of a first virtual router. The method also includes forwarding the network packet from the ingress interface of the first virtual router to the egress interface of the second virtual router using the direct forwarding path, wherein the network packet traverses a switch fabric directly from the ingress interface of the first virtual router to the egress interface of the second virtual router.

Abstract: A method performed by a network system having a plurality of processing units implemented using a plurality of respective virtual machines, includes: receiving a first packet at a first virtual machine of the plurality of virtual machines, wherein the first virtual machine is configured to receive the first packet from a network through an interface and has session processing capability; calculating a first value using a mathematical algorithm based on one or more information regarding the first packet; and using the calculated first value to identify a second virtual machine of the plurality of virtual machines in the network system.

Abstract: A method performed by a network appliance having a plurality of application processing units, includes: receiving a first packet at the network appliance; calculating a first value using a mathematical algorithm based on one or more information regarding the first packet; and using the calculated first value to identify a first application processing unit of the plurality of application processing units in the network appliance. A network appliance includes: a plurality of processing units that are communicatively connected to each other; wherein a first processing unit of the plurality of processing units is configured for: calculating a first value using a mathematical algorithm based on one or more information regarding a first packet; and using the calculated first value to identify a second processing unit of the plurality of processing units.

Abstract: A device may reserve a slot for a received packet in a packet ordering queue (POQ), convey the packet to one of a plurality of threads for processing, obtain the packet from the one of the plurality of threads after the packet has been processed, organize the packet in the POQ in accordance with a position of the reserved slot, and release the packet from the POQ if the reserved slot is a head of the POQ.