Abstract: Disclosed herein are methods of forwarding data over an IP network. The methods may include receiving a packet from a source host connected to the IP network, identifying the IP address of a destination host designated in the packet, determining the location on the IP network where the destination host designated by the packet is connected, without reference to the MAC address specified in the packet, by using location-identification information stored on the IP network, and forwarding the packet to the location on the IP network where the destination host is connected without reference to the MAC address specified in the packet. Also disclosed herein are related network devices implementing such techniques and operations, as well as IP networks which include such network devices.

Abstract: Disclosed herein are methods of forwarding data over an IP network. The methods may include receiving a packet from a source host connected to the IP network, identifying the IP address of a destination host designated in the packet, determining the location on the IP network where the destination host designated by the packet is connected, without reference to the MAC address specified in the packet, by using location-identification information stored on the IP network, and forwarding the packet to the location on the IP network where the destination host is connected without reference to the MAC address specified in the packet. Also disclosed herein are related network devices implementing such techniques and operations, as well as IP networks which include such network devices.

Abstract: Disclosed herein are methods of forwarding packets on a network, such as a leaf-spine network having leaf devices and spine devices. The methods may include receiving a packet at an ingress leaf device, and determining based, at least in part, on a header of the packet whether the packet is to be transmitted to a spine device. The methods may further include ascertaining based, at least in part, on a header of the packet whether to perform encapsulation on the packet, encapsulating the packet according to a result of the ascertaining, and then transmitting the packet to a spine device according to a result of the determining. Also disclosed herein are network apparatuses which include a processor and a memory, at least one of the processor or the memory being configured to perform some or all of the foregoing described methods.

Abstract: Techniques are provided herein to achieve data security and integrity using the cryptographic machinery of IEEE MACSec for TCP or UDP packets, for example, VxLAN, iVxLAN, and VxLAN-GPE packet. In particular, the disclosed techniques generate InsSec packets from received VxLAN based packets, in which the generated InsSec packets include an integrity checksum that that does not cover the MAC address of the packet.

Abstract: Disclosed herein are methods and related apparatuses for determining statistics descriptive of packets received at a particular location on a network out of a set of packets transmitted on the network, which include transmitting first and second groups of packets on the network, the packets in the first and second groups labeled with first and second labels, respectively (the packets in the second group not in the first group), incrementing first and second packet counters associated with the particular network location in response to packet(s) in the first and second groups, respectively, being received at the network location until all packets in the first and second groups have drained from the network, and using values read from the first and second packet counters to determine a statistic descriptive of the packets received at the particular network location out of those in the first and second groups transmitted on the network.

Abstract: In one embodiment, a next set of packets in a first flow may be identified. A counter may be incremented, where the counter indicates a first number of initial sets of packets in first flow that have been identified. The identified next set of packets may be prioritized such that the first number of initial sets of packets in the first flow are prioritized and a sequential order of all packets in the first flow is maintained. The identifying, incrementing, and prioritizing may be repeated until no further sets of packets in the first flow remain to be identified or the first number of initial sets of packets is equal to a first predefined number.

Abstract: Disclosed herein are methods and related apparatuses for determining statistics descriptive of packets received at a particular location on a network out of a set of packets transmitted on the network, which include transmitting first and second groups of packets on the network, the packets in the first and second groups labeled with first and second labels, respectively (the packets in the second group not in the first group), incrementing first and second packet counters associated with the particular network location in response to packet(s) in the first and second groups, respectively, being received at the network location until all packets in the first and second groups have drained from the network, and using values read from the first and second packet counters to determine a statistic descriptive of the packets received at the particular network location out of those in the first and second groups transmitted on the network.

Abstract: Disclosed herein are methods of forwarding packets on a network, such as a leaf-spine network having leaf devices and spine devices. The methods may include receiving a packet at an ingress leaf device, and determining based, at least in part, on a header of the packet whether the packet is to be transmitted to a spine device. The methods may further include ascertaining based, at least in part, on a header of the packet whether to perform encapsulation on the packet, encapsulating the packet according to a result of the ascertaining, and then transmitting the packet to a spine device according to a result of the determining. Also disclosed herein are network apparatuses which include a processor and a memory, at least one of the processor or the memory being configured to perform some or all of the foregoing described methods.

Abstract: Techniques are provided herein to achieve data security and integrity using the cryptographic machinery of IEEE MACSec for TCP or UDP packets, for example, VxLAN, iVxLAN, and VxLAN-GPE packet. In particular, the disclosed techniques generate InsSec packets from received VxLAN based packets, in which the generated InsSec packets include an integrity checksum that that does not cover the MAC address of the packet.

Abstract: Disclosed herein are methods and related apparatuses for determining statistics descriptive of packets received at a particular location on a network out of a set of packets transmitted on the network, which include transmitting first and second groups of packets on the network, the packets in the first and second groups labeled with first and second labels, respectively (the packets in the second group not in the first group), incrementing first and second packet counters associated with the particular network location in response to packet(s) in the first and second groups, respectively, being received at the network location until all packets in the first and second groups have drained from the network, and using values read from the first and second packet counters to determine a statistic descriptive of the packets received at the particular network location out of those in the first and second groups transmitted on the network.

Abstract: Disclosed herein are methods of forwarding packets on a network, such as a leaf-spine network having leaf devices and spine devices. The methods may include receiving a packet at an ingress leaf device, and determining based, at least in part, on a header of the packet whether the packet is to be transmitted to a spine device. The methods may further include ascertaining based, at least in part, on a header of the packet whether to perform encapsulation on the packet, encapsulating the packet according to a result of the ascertaining, and then transmitting the packet to a spine device according to a result of the determining. Also disclosed herein are network apparatuses which include a processor and a memory, at least one of the processor or the memory being configured to perform some or all of the foregoing described methods.

Abstract: In one embodiment, a next set of packets in a first flow may be identified. A counter may be incremented, where the counter indicates a first number of initial sets of packets in first flow that have been identified. The identified next set of packets may be prioritized such that the first number of initial sets of packets in the first flow are prioritized and a sequential order of all packets in the first flow is maintained. The identifying, incrementing, and prioritizing may be repeated until no further sets of packets in the first flow remain to be identified or the first number of initial sets of packets is equal to a first predefined number.

Abstract: In one embodiment, a next set of packets in a first flow may be identified. A counter may be incremented, where the counter indicates a first number of initial sets of packets in first flow that have been identified. The identified next set of packets may be prioritized such that the first number of initial sets of packets in the first flow are prioritized and a sequential order of all packets in the first flow is maintained. The identifying, incrementing, and prioritizing may be repeated until no further sets of packets in the first flow remain to be identified or the first number of initial sets of packets is equal to a first predefined number.

Abstract: Disclosed herein are methods of forwarding data over an IP network. The methods may include receiving a packet from a source host connected to the IP network, identifying the IP address of a destination host designated in the packet, determining the location on the IP network where the destination host designated by the packet is connected, without reference to the MAC address specified in the packet, by using location-identification information stored on the IP network, and forwarding the packet to the location on the IP network where the destination host is connected without reference to the MAC address specified in the packet. Also disclosed herein are related network devices implementing such techniques and operations, as well as IP networks which include such network devices.

Abstract: Disclosed herein are methods of forwarding packets on a network, such as a leaf-spine network having leaf devices and spine devices. The methods may include receiving a packet at an ingress leaf device, and determining based, at least in part, on a header of the packet whether the packet is to be transmitted to a spine device. The methods may further include ascertaining based, at least in part, on a header of the packet whether to perform encapsulation on the packet, encapsulating the packet according to a result of the ascertaining, and then transmitting the packet to a spine device according to a result of the determining. Also disclosed herein are network apparatuses which include a processor and a memory, at least one of the processor or the memory being configured to perform some or all of the foregoing described methods.

Abstract: In one embodiment, a next set of packets in a first flow may be identified. A counter may be incremented, where the counter indicates a first number of initial sets of packets in first flow that have been identified. The identified next set of packets may be prioritized such that the first number of initial sets of packets in the first flow are prioritized and a sequential order of all packets in the first flow is maintained. The identifying, incrementing, and prioritizing may be repeated until no further sets of packets in the first flow remain to be identified or the first number of initial sets of packets is equal to a first predefined number.

Abstract: Disclosed herein are methods and related apparatuses for determining statistics descriptive of packets received at a particular location on a network out of a set of packets transmitted on the network, which include transmitting first and second groups of packets on the network, the packets in the first and second groups labeled with first and second labels, respectively (the packets in the second group not in the first group), incrementing first and second packet counters associated with the particular network location in response to packet(s) in the first and second groups, respectively, being received at the network location until all packets in the first and second groups have drained from the network, and using values read from the first and second packet counters to determine a statistic descriptive of the packets received at the particular network location out of those in the first and second groups transmitted on the network.

Abstract: In one embodiment, a solution is provided wherein redundant routers are treated as a single emulated switch. When a packet is received at a layer 2 edge switch from a host, the layer 2 edge switch may determine a switch identifier for the emulated switch using a destination anycast hardware address contained in the packet. The anycast hardware address may identify an emulated switch comprising a plurality of routers. Then a header may be added to the packet, the header including the switch identifier. Following that, the packet may be forwarded to another layer 2 switch along a shortest path from the layer 2 edge switch to the emulated switch.

Abstract: Methods and apparatus for implementing storage virtualization on a network device of a storage area network are disclosed. A frame or packet is received at a port of the network device. It is then determined that the frame or packet pertains to access of a virtual storage location of a virtual storage unit representing one or more physical storage locations on one or more physical storage units of the storage area network. A virtual-physical mapping between the one or more physical storage locations and the virtual storage location is then obtained. A new or modified frame or packet is then sent to an initiator or a target specified by the virtual-physical mapping.

Abstract: Methods and devices are provided for implementing security groups in an enterprise network. The security groups include first network nodes that are subject to rules governing communications between the first network nodes and second network nodes. An indicator, referred to as a security group tag (SGT), identifies members of a security group. In some embodiments, the SGT is provided in a field of a data packet reserved for layer 3 information or a field reserved for higher layers. However, in other embodiments, the SGT is provided in a field reserved for layer 1 or layer 2. In some embodiments, the SGT is not provided in a field used by interswitch links or other network fabric devices for the purpose of making forwarding decisions.