Abstract: A recommendation system can be configured to provide tailored software update relevance information for deployed software. The recommendation engine can obtain running state information for a current version of software running on a device, as well as build data for each of the current version of the software and a new version of the software. The recommendation engine can obtain software version difference information based on the build data and determine, based on at least the software version difference information and the running state information, a number of functions in the current version of software that are directly impacted by the new version. The recommendation engine can cause relevance information derived from this determination to be displayed on a computing device, and/or the recommendation engine can automatically cause an update to the new version of the software to be applied or rejected based on the determination.

Abstract: A pseudo-active/active firewall configuration handles firewall switchover events without traffic disruption. A passive firewall is set to an active state, and an active firewall is switched to a pseudo-active state wherein it continues to process ingress and egress traffic according to traffic handling protocols for its active state. An Internet protocol address binding linking the now pseudo-active firewall to an Internet gateway that forwards traffic to the firewalls is updated in a network address translation (NAT) table to route traffic to the newly active firewall. Once a pseudo-active timer expires and the binding is successfully updated to route traffic to the newly active firewall, the pseudo-active firewall is set to a passive state.

Abstract: A pseudo-active/active firewall configuration handles firewall switchover events with minimized session disconnection. A passive firewall is set to an active state, and an active firewall is switched to a pseudo-active state wherein it continues to process ingress and egress traffic according to traffic handling protocols for its active state. During updating of a corresponding Network Address Translation (NAT) table to route traffic to the now-active firewall, the pseudo-active firewall enters a forwarding state wherein it forwards ingress network sessions to the now-active firewall and processes the ingress network sessions according to its active state. The now-active firewall receives the ingress network sessions and records session states prior to discarding them. After updating the NAT table, when traffic is routed to the now-active firewall, the recorded session states are used to maintain active sessions.

Abstract: A pseudo-active/active firewall configuration handles firewall switchover events without traffic disruption. A passive firewall is set to an active state, and an active firewall is switched to a pseudo-active state wherein it continues to process ingress and egress traffic according to traffic handling protocols for its active state. An Internet protocol address binding linking the now pseudo-active firewall to an Internet gateway that forwards traffic to the firewalls is updated in a network address translation (NAT) table to route traffic to the newly active firewall. Once a pseudo-active timer expires and the binding is successfully updated to route traffic to the newly active firewall, the pseudo-active firewall is set to a passive state.

Abstract: A recommendation system can be configured to provide tailored software update relevance information for deployed software. The recommendation engine can obtain running state information for a current version of software running on a device, as well as build data for each of the current version of the software and a new version of the software. The recommendation engine can obtain software version difference information based on the build data and determine, based on at least the software version difference information and the running state information, a number of functions in the current version of software that are directly impacted by the new version. The recommendation engine can cause relevance information derived from this determination to be displayed on a computing device, and/or the recommendation engine can automatically cause an update to the new version of the software to be applied or rejected based on the determination.

Abstract: Exemplary techniques for architecture-independent dynamic flow learning in a packet forwarder are described. A packet forwarder includes a plurality of forwarding threads and a plurality of provisioning threads, and can implement three functional blocks to learn new flows—an admission control block, a forwarding database building block, and a notification path block. An admission control module can control the ability for forwarding threads to place flow operation requests in operation queues. Provisioning threads independently manage particular operation queues, and can update corresponding portions of a control database and a forwarding database. Flow operation notifications can be managed through notification queues, which can be drained back into the operation queues for the provisioning threads to later process. The packet forwarder thus can benefit from a highly-parallel, highly-efficient software-based approach to flow learning operations that does not require specialized hardware support.

Abstract: Exemplary techniques for architecture-independent dynamic flow learning in a packet forwarder are described. A packet forwarder includes a plurality of forwarding threads and a plurality of provisioning threads, and can implement three functional blocks to learn new flows—an admission control block, a forwarding database building block, and a notification path block. An admission control module can control the ability for forwarding threads to place flow operation requests in operation queues. Provisioning threads independently manage particular operation queues, and can update corresponding portions of a control database and a forwarding database. Flow operation notifications can be managed through notification queues, which can be drained back into the operation queues for the provisioning threads to later process. The packet forwarder thus can benefit from a highly-parallel, highly-efficient software-based approach to flow learning operations that does not require specialized hardware support.

Abstract: A method in a network device of flow learning in a network device are provided. The method comprises determining whether the flow of a packet is being learnt by the network device; in response to determining that the flow is already being learnt, forwarding the packet without sending a request to insert a new entry in one of the set of one or more forwarding tables; and in response to determining that the flow is not yet being learnt, performing: 1) updating a retrieved flow learning element to include a second portion of a flow identification, 2) sending a request to store the updated flow learning element into a flow learning table, and 3) in response to determining that the updated flow learning element is stored, sending a request to insert a new entry associated with the flow of the packet in a forwarding table.

Abstract: A method and network element identify a set of bit indices for forming compressed keys, which are used to map a set of keys of corresponding input values to assigned lookup values in a hash table, where the keys of the input values have colliding hash values according to a hash function of the hash table. The method includes a set of steps including receiving the set of keys. The bits of the set of keys are traversed to find a best split bit index. The set of keys are split into two subsets according to the best split bit index. A check is made whether all of the set of keys have been split into separate subsets. A selected best split bit is added to a bit index. Alternate split bits are tallied and a bit is selected with a highest tally to add to bit index.

Abstract: In one embodiment of the invention, a number of transport protocol streams are established between a signaling session border controller (S-SBC) and a data session border controller (D-SBC). A subset of the number of transport protocol streams are dedicated for carrying messages for emergency calls. Upon receiving an emergency call, the S-SBC transmits an add request message to the D-SBC over one of the streams dedicated for carrying messages for emergency calls. Upon receiving the message over one of the streams dedicated for carrying messages for emergency calls, the D-SBC processes the message with high priority handling.

Abstract: In one embodiment of the invention, a number of transport protocol streams are established between a signaling session border controller (S-SBC) and a data session border controller (D-SBC). A subset of the number of transport protocol streams are dedicated for carrying messages for emergency calls. Upon receiving an emergency call, the S-SBC transmits an add request message to the D-SBC over one of the streams dedicated for carrying messages for emergency calls. Upon receiving the message over one of the streams dedicated for carrying messages for emergency calls, the D-SBC processes the message with high priority handling.