Abstract: Provided are methods and apparatus that enforce zoning rules by separately employing source and destination information. In certain embodiments, information uniquely identifying network destinations is provided on a destination CAM. In these embodiments, each destination identified in the destination CAM has an associated zoning decision vector provided in a results memory. The vector provides specific zoning decisions (permit or deny transmission) for specific sources on the network. The specific zoning decision to be applied to a frame under consideration is selected from a zoning decision vector by using source information taken from the frame.

Abstract: Methods and apparatus for performing encryption for data at rest at a port of a network device such as a switch are disclosed. Specifically, when data is received from a host during a write to a storage medium such as a disk, the data is encrypted by the port prior to transmitting the encrypted data to the storage medium. Similarly, when a host attempts to read data from the storage medium, the port of the network device receives the encrypted data from the storage medium, decrypts the data, and transmits the decrypted data to the host. In this manner, encryption and decryption of data at rest are supported by the port of the network device.

Abstract: Methods and devices are provided for the efficient allocation and deletion of virtual output queues. According to some implementations, incoming packets are classified according to a queue in which the packet (or classification information for the packet) will be stored, e.g., according to a “Q” value. For example, a Q value may be a Q number defined as {Egress port number?Priority number?Ingress port number}. Only a single physical queue is allocated for each classification. When a physical queue is empty, the physical queue is preferably de-allocated and added to a “free list” of available physical queues. Accordingly, the total number of allocated physical queues preferably does not exceed the total number of classified packets. Because the input buffering requirements of Fiber Channel (“FC”) and other protocols place limitations on the number of incoming packets, the dynamic allocation methods of the present invention result in a sparse allocation of physical queues.

Abstract: Methods and devices are provided for non-disruptive monitoring of network traffic through one or more ports of a Fibre Channel network device. Preferred embodiments of the invention are used in conjunction with the switched port analyzer (“SPAN”) and/or remote SPAN (“RSPAN”) features. SPAN mode operation allows traffic through any Fibre Channel interface of a network device to be replicated and delivered to a single port on the same network device. Ingress SPAN allows the monitoring of some or all packets that ingress a specified port or ports. Egress SPAN allows the monitoring of some or all packets that egress a specified port or ports. RSPAN allows the delivery of the replicated traffic to a port on a remote network device. Filtering may be applied, for example, to SPAN packets having selected virtual storage area network numbers.

Abstract: Methods and apparatus are provided for controlling congestion in a network such as a fibre channel network. Techniques are provided for characterizing traffic flow at a congested network node. The congested network node can generate various instructions such as quench messages to control traffic flow towards the congested network node. The quench messages can optionally include information about the characteristics of the congestion. The instructions are distributed to other nodes in the network. The other network nodes can interpret the instructions and control traffic flow towards the congested node.

Abstract: Methods and devices are provided for non-disruptive monitoring of network traffic through one or more ports of a Fibre Channel network device. Preferred embodiments of the invention are used in conjunction with the switched port analyzer (“SPAN”) and/or remote SPAN (“RSPAN”) features. SPAN mode operation allows traffic through any Fibre Channel interface of a network device to be replicated and delivered to a single port on the same network device. Ingress SPAN allows the monitoring of some or all packets that ingress a specified port or ports. Egress SPAN allows the monitoring of some or all packets that egress a specified port or ports. RSPAN allows the delivery of the replicated traffic to a port on a remote network device. Filtering may be applied, for example, to SPAN packets having selected virtual storage area network numbers.

Abstract: Methods and devices are provided for non-disruptive monitoring of network traffic through one or more ports of a Fibre Channel network device. Preferred embodiments of the invention are used in conjunction with the switched port analyzer (“SPAN”) and/or remote SPAN (“RSPAN”) features. SPAN mode operation allows traffic through any Fibre Channel interface of a network device to be replicated and delivered to a single port on the same network device. Ingress SPAN allows the monitoring of some or all packets that ingress a specified port or ports. Egress SPAN allows the monitoring of some or all packets that egress a specified port or ports. RSPAN allows the delivery of the replicated traffic to a port on a remote network device. Filtering may be applied, for example, to SPAN packets having selected virtual storage area network numbers.

Abstract: Methods and apparatus are provided for controlling congestion in a network such as a fiber channel network. Techniques are provided for detecting congestion at a shared resource such as a network node. When a controller sends data to a shared resource, the delay between sending the data and receiving a credit is measured. If the delay is significant, it is assumed that the path towards the destination associated with the data is congested and subsequent traffic from the port associated with the data is blocked.

Abstract: According to the present invention, methods and apparatus are provided to improve the techniques and mechanisms for forwarding packets at a fiber channel switch. A combined area table/domain table (ATDT) is accessed using destination information associated with a fiber channel packet. Area/port or domain information can be used to address entries in the ATDT. Each entry provides one or more paths to a given destination. Traffic shaping, load balancing, and other policy based forwarding considerations can be applied.

Abstract: Methods and apparatus are provided for alleviating deadlock and controlling congestion in a network such as a fibre channel network. Techniques are provided for detecting stalled frames at a fibre channel switch. Reserve credits are released when stalled frames are detected. In some instances, reserve credits are released after a predetermined period of time. Reserve credits allow transmission to effectively reduce deadlock and congestion. Reserve credits are particularly effective in reducing deadlock resulting from transient loops in a fibre channel network.

Abstract: A hardware search engine facility is provided to allow CPU search and update of a Forwarding Table CAM under the control of software running on the CPU. The hardware search engine provides one or more comparand-mask pairs which allow for a match, exclusion or magnitude comparison on specific entry values and/or the option to ignore or “don't care” certain bits of the entry. Control registers may be set in software to specify a start address and stop address in the CAM for the search. An indication of valid or invalid entries may be provided as well. Once the search is initiated by software, the search engine will read the entries sequentially starting from the programmed start address. It will perform a compare using the comparand-mask pair and attempt to identify a match. The locations in the CAM which match the search criteria may be put into a CPU-accessible memory. If the memory fills up before it can be read by the software, the search may be halted until the memory is emptied.

Abstract: A method and apparatus for implementing Quality of Service (QoS) policy in a data communications network. A content addressable memory (CAM) contains flow information for each active flow of packets passing through a given node of a data communications network. The CAM has associated with each entry a packet counter, a byte counter, a token bucket, and a contract value. Each flow is assigned one of a plurality of output queues and optionally at least one output threshold value. An access control list CAM (ACLCAM) contains masked flow information. The ACLCAM provides an index to internal token bucket counters and preconfigured contract values of an aggregate flow table which becomes affected by the packet statistics. In this way, flows are aggregated for assignment of output queues and thresholds, possible dropping, and possible modification of packets.

Abstract: A method and apparatus for implementing Quality of Service (QoS) policy in a data communications network. An active flow content addressable memory (CAM) contains entries of flow information for each active flow of packets passing through a given node of the data communications network. The CAM has associated with each entry a packet counter, a byte counter, a token bucket, and a contract value. Each flow is assigned one of a plurality of output queues and optionally at least one output threshold value. A token bucket algorithm is employed on each flow to determine whether packets from that flow exceed the contract value. Such packets may be dropped or optimally modified to reflect an alternate output queue and/or alternate threshold before being sent to the selected output queue for transmission from the node.

Abstract: A content addressable memory (CAM or L3 Table) contains flow information for each active flow of packets passing through a given node of a data communications network. The CAM has associated with each entry (corresponding to each active flow) a packet counter, a byte counter, a token bucket and a contract value. Each flow is assigned one of a plurality of output queues and optionally at least one output threshold value. A token bucket algorithm is employed on each flow to determine whether packets from that flow exceed the contract value. Such packets may be dropped or optimally modified to reflect an alternate output queue and/or alternate threshold before being sent to the selected output queue for transmission from the node. In another aspect an access control list CAM (ACLCAM) contains masked flow information. The ACLCAM provides an index to internal token bucket counters and preconfigured contract values of an aggregate flow table which becomes affected by the packet statistics.

Abstract: A content addressable memory (CAM or L3 Table) contains flow information for each active flow of packets passing through a given node of a data communications network. The CAM has associated with each entry (corresponding to each active flow) a packet counter, a byte counter, a token bucket and a contract value. Each flow is assigned one of a plurality of output queues and optionally at least one output threshold value. A token bucket algorithm is employed on each flow to determine whether packets from that flow exceed the contract value. Such packets may be dropped or optimally modified to reflect an alternate output queue and/or alternate threshold before being sent to the selected output queue for transmission from the node. In another aspect an access control list CAM (ACLCAM) contains masked flow information. The ACLCAM provides an index to internal token bucket counters and preconfigured contract values of an aggregate flow table which becomes affected by the packet statistics.

Abstract: Methods and apparatus are provided for controlling congestion in a network such as a fibre channel network. Techniques are provided for characterizing traffic flow at a congested network node. The congested network node can generate various instructions such as quench messages to control traffic flow towards the congested network node. The quench messages can optionally include information about the characteristics of the congestion. The instructions are distributed to other nodes in the network. The other network nodes can interpret the instructions and control traffic flow towards the congested node.

Abstract: A hardware search engine facility is provided to allow CPU search and update of a Forwarding Table CAM under the control of software running on the CPU. The hardware search engine provides one or more comparand-mask pairs which allow for a match, exclusion or magnitude comparison on specific entry values and/or the option to ignore or “don't care” certain bits of the entry. Control registers may be set in software to specify a start address and stop address in the CAM for the search. An indication of valid or invalid entries may be provided as well. Once the search is initiated by software, the search engine will read the entries sequentially starting from the programmed start address. It will perform a compare using the comparand-mask pair and attempt to identify a match. The locations in the CAM which match the search criteria may be put into a CPU-accessible memory. If the memory fills up before it can be read by the software, the search may be halted until the memory is emptied.