Abstract: Subsets of isolated communications networks are selectively merged without merging the entire isolated communications networks, and devices are imported across isolated communications networks without merging the isolated communications networks. The presently disclosed technology provides for improved scalability, performance, and security in logical networks spanning two or more physical communications networks.

Abstract: A solution for tunnel path MTU discovery includes, at a first network device configured as an origination endpoint for a tunnel, storing a keep-alive packet having a size of an interface maximum transmission unit (MTU), the keep-alive packet indicating the packet should not be fragmented, the second network device configured as a termination endpoint for the tunnel. If the sending fails, the size of the keep-alive packet is iteratively changed to converge upon a path MTU, where the path MTU is the size of a largest keep-alive packet that can be sent from the first network device to the second network device without fragmentation.

Abstract: A Fibre Channel router used to join fabrics. EX_ports are used to connect to the fabrics. The EX_port joins the fabric but the router will not merge into the fabric. Ports in the Fibre Channel router can be in a fabric, but other ports can be connected to other fabrics. Fibre Channel routers can be interconnected using a backbone fabric. Global, interfabric and encapsulation headers are developed to allow routing by conventional Fibre Channel switch devices in the backbone fabric and simplify Fibre Channel router routing. Phantom domains and devices must be developed for each of the fabrics being interconnected. Front phantom domains are present at each port directly connected to a fabric. Each of these is then connected to at least one translate phantom domain. Zoning is accomplished by use of a special LSAN zoning naming convention. This allows each administrator to independently define devices are accessible.

Abstract: A fabric having switches interconnected with multiple parallel interswitch links can be configured using staged port bring up. Only one of the multiple parallel interswitch links between any two switches and the corresponding switch ports can be selected and initialized. The fabric can be configured with the selected ISLs. Once the fabric has stabilized, unselected ISLs and the corresponding switch ports can be incrementally initialized. The number of unselected ISLs to be initialized can be determined based on the available computing resources of the fabric switches.

Abstract: A switch may be used to force the expiration of a cookie on a user's system by inserting an expiration field into the cookie contained in a network response packet. Additionally, a mechanism is provided to delete or damage a cookie contained in a network request packet, so that server software is not disrupted by the receipt of a cookie. Deleting a cookie results in a cleaner request, but damaging a cookie may be more efficient in certain circumstances. By providing these features, an efficient cookie switching design is provided.

Abstract: One embodiment of the present invention provides a system that facilitates automatic adjustment of logical channels in a Fiber Channel (FC) network. During operation, the system receives FC data frames. A respective data frame is associated with a logical channel. The bandwidth on an FC link can be allocated into a plurality of logical channels, and a respective logical channel is associated with a dedicated buffer and can transport a plurality of data flows with data frames of variable length. The system then identifies a slow data flow in a first logical channel. Next, the system assigns the slow data flow to a second logical channel, thereby preventing the slow data flow from slowing down other data flows in the first logical channel. The system subsequently forwards the data frames in the slow data flow on the second logical channel onto an outgoing link.

Abstract: Techniques for efficiently storing and using routing and associated next-hop information in a network device. The amount of next-hop information that is stored for routes in a routing table is reduced by reducing the amount of duplicate next-hop information that is stored by a network device.

Abstract: Techniques for provisioning single or multistage networks using Ethernet Service Instances (ESIs). In one embodiment, an ESI is a logical entity or object that stores information that may be used to provision a network. An ESI may represent a logical entity that identifies a grouping of elements of a network or network device and associated attributes. Hierarchical relationships may be created between ESIs. The hierarchical relationships are used to perform packet-level processing including performing network packet encapsulations.

Abstract: A routing system utilizes a layer 2 switch interconnecting several routers to intelligently forward multicast packets throughout an internet exchange carrying multicast content. The layer 2 switch performs protocol snooping to extract a lookup key that is based on network layer protocol information. The lookup key is uniquely formulated to support either shared or explicit source distribution trees. The lookup key is used to query a forwarding memory that returns an outgoing port index. The outgoing port index points to one or more outgoing ports that are eligible to receive the multicast packet. The outgoing ports are also connected to the neighboring device(s) that are designated to receive the multicast packet. The routing system also supports real time maintenance and updating of the forwarding memory based on the periodic exchange of control messages. The routing system is configured to support PIM routers operating in PIM SM or PIM SSM modes.

Abstract: A solution for virtual router redundancy for server virtualization includes, at a network device configured as a backup router of a virtual router, examining a packet stored in a memory of the network device. Responsive to the examining, the network device determines whether to forward the packet via a network towards a destination or to send the packet via the network to a master router of the virtual router for forwarding of the packet, by the master router, towards the destination.

Abstract: Pluggable transceiver modules with additional functions and circuitry contained within the module. In a first embodiment, additional circuitry is added to determine bit error rates at the point of the module itself. This allows a much better diagnostic evaluation of location of problem. In an alternate embodiment, various logic is placed in the module. In a first alternate embodiment encryption/decryption units are placed in the converter module so that encryption and decryption operations on the serial bitstream do not need to be performed in a switch. Existing switches can be used but the interconnecting links can still be encrypted. A second alternate embodiment includes compression/decompression units placed in the module to allow effective higher throughput on the selected links.

Abstract: A system and method which enables a provider network to run a loop detection protocol in a customer network communicably coupled to it. The provider network runs a loop detection protocol and the customer network either runs a different protocol or none. The provider network determines its root bridge, or designated customer bridge, which is used to control loop detection decisions for the customer network. A BPDU or other protocol packet received from the customer network is tunneled through the provider network to the designated customer bridge. The designated customer network then processes the received BPDU in accordance with a loop detection instance for the customer network. The designated customer bridge then produces control messages in response to the processing and forwards those messages to the customer network. The control messages may include port state controls for ports in the customer network.

Abstract: An exact match lookup system includes a hash function that generates a hash value in response to an input hash key. The hash value is used to retrieve a hash bucket index value from a hash bucket index table. The hash bucket index value is used to retrieve a plurality of hash keys from a plurality of hash bucket tables, in parallel. The retrieved hash keys are compared with the input hash key to identify a match. Hit logic generates an output index by concatenating the hash bucket index value with an address associated with the hash bucket table that provides the matching hash key. An exact match result is provided in response to the output index. A content addressable memory (CAM) may store hash keys that do not fit in the hash bucket tables.

Abstract: Remote management of a plurality of network devices is described wherein each device is managed with its own unsigned Java™ applet. Unsigned applets launched from different devices operate within the same shared environment of a webpage. Furthermore, a transmitting applet communicates with a recipient applet. In one embodiment, the recipient applet is a central management applet that combines data from 10 a plurality of devices into one data pool, which can then be used to provide higher level management capabilities. A combination of centralized management and distributed management is allowed within the Java security model, without having to resort to signed Java applets or Java applications.

Abstract: Techniques for efficiently updating routing information in a network device such as a router. According to an embodiment of the present invention, information is stored identifying one or more nodes and leaves owned or advertised by the nodes. When a change occurs in a network environment, information is stored identifying one or more nodes and leaves that have changes associated with them. The routing information in the network device is then updated for only those nodes and leaves that have changes associated with them.

Abstract: A solution for scalable key archival includes, at a network device, determining whether a key management device that is not part of a current key management device configuration has been newly added to a network. The method also includes, if the key management device has been newly added to the network, determining whether the network device has a first application program interface (API) or device driver for communicating with the key management device. The method also includes, if the network device does not have the first API, obtaining the API. The method also includes creating a binding between a virtual device driver of the network device and the key management device via the first API, the network device having a second API for communications between the virtual device driver and a security processor of the network device. The security processor communicates with the key management device using the second API.

Abstract: A smoothing algorithm for round trip time (RTT) measurements is provided to a network device to effectively deal with variations or other potential anomalies that may occur in RTT measurements. The algorithm involves: first determining what should be considered a very high or a very small value for a RTT sample. If a new RTT sample is in an acceptable range, then the network device performs a relatively basic smoothing. If the new RTT sample is much higher than a current RTT value, then the network device ignores the value of this RTT sample a few times. If the network device still detects this large value after ignoring that value for some time, then the network device factors this value into the current RTT value using an additive increase. Similarly, if the value of the new RTT sample is much lower than current RTT value, the network device ignores the value of the new RTT sample a few times.

Abstract: An IP gateway device establishes distinct TCP sessions within a single FCIP tunnel, each TCP session being designated for a different priority of service (e.g., high, medium, low), plus a control stream. Each TCP session has its own TCP stack and its own settings for VLAN Tagging (IEEE 802.1Q), quality of service (IEEE 802.1P) and Differentiated Services Code Point (DSCP). By distributing data streams assigned to different priorities of service into different TCP sessions within the FCIP tunnel, an IP gateway device can preserve the distinctions between the data stream priorities while the data traffic is within the IP network.

Abstract: A switch may be used to force the expiration of a cookie on a user's system by inserting an expiration field into the cookie contained in a network response packet. Additionally, a mechanism is provided to delete or damage a cookie contained in a network request packet, so that server software is not disrupted by the receipt of a cookie. Deleting a cookie results in a cleaner request, but damaging a cookie may be more efficient in certain circumstances. By providing these features, an efficient cookie switching design is provided.

Abstract: An isolation switch blade Fiber Channel switch presents F_ports to form a first Fiber Channel fabric and N_ports to a second Fiber Channel fabric to appear as node devices. The isolation switch blade may be used to connect a plurality of blade servers to a Fiber Channel fabric. Fabric events engendered by the insertion or removal of hot-pluggable devices are handled by the isolation switch blade and “event storms” on the Fiber Channel fabric are avoided. The isolation switch blade presents the blade servers to the FC fabric as a virtualized N_port.