Abstract: A network configuration device or entity has control of defined management and security functions in the network, or in many embodiments, in a Fiber Channel fabric. The network configuration device may control many functions. Foremost, it may control the recognition, operation and succession procedure for network configuration entities. It may also control user configurable options for the network, rules for interaction between other entities in the network, rules governing management-level access to the network, and rules governing management-level access to individual devices in the network. In addition, the network configuration entity may exploit policy sets to implement its control.

Abstract: The snapshot capability moving into the SAN fabric and being provided as a snapshot service. A well-known address is utilized to receive snapshot commands. Each switch in the fabric connected to a host contains a front end or service interface to receive the snapshot command. Each switch of the fabric connected to a storage device used in the snapshot process contains a write interceptor module which cooperates with hardware in the switch to capture any write operations which would occur to the snapshot data area. The write interceptor then holds these particular write operations until the original blocks are transferred to a snapshot or separate area so that the original read data is maintained. Should a read operation occur to the snapshot device and the original data from requested location has been relocated, a snapshot server captures these commands and redirects the read operation to occur from the snapshot area.

Abstract: A network device includes a plurality of blades, each having a plurality of CPU cores that process requests received by the network device. Each blade further includes an accumulator circuit. Each accumulator circuit periodically aggregates the local counter values of the CPU cores of the corresponding blade. One accumulator circuit is designated as a master, and the other accumulator circuit(s) are designated as slave(s). The slave accumulator circuits transmit their aggregated local counter values to the master accumulator circuit. The master accumulator circuit aggregates the sets of aggregated local counter values to create a set of global counter values. The master accumulator circuit transmits the global counter values to a management processor (for display), to the CPU cores located on its corresponding blade, and to each of the slave accumulator circuits. Each slave accumulator circuit then transmits the global counter values to the CPU cores located on its corresponding blade.

Abstract: A system, method and apparatus for providing multiple access modes in a data communications network includes a network access device having a plurality of input ports, a plurality of output ports, and a switching fabric for routing data received on the plurality of input ports to at least one of the plurality of output ports. Control logic within the network access device is adapted to determine whether a user device coupled to one of the plurality of input ports supports a user authentication protocol used by a host network. If the user authentication protocol is not supported, then the input port to which the network access device is coupled is placed in a semi-authorized access state that limits access to a pre-configured network accessible via the host network.

Abstract: A system including a storage processing device with an input/output module. The input/output module has port processors to receive and transmit network traffic. The input/output module also has a switch connecting the port processors. Each port processor categorizes the network traffic as fast path network traffic or control path network traffic. The switch routes fast path network traffic from an ingress port processor to a specified egress port processor. The storage processing device also includes a control module to process the control path network traffic received from the ingress port processor. The control module routes processed control path network traffic to the switch for routing to a defined egress port processor. The control module is connected to the input/output module. The input/output module and the control module are configured to interactively support data virtualization, data migration, data journaling, and snapshotting.

Abstract: In a network, a user can configure host-level policies usable for load balancing traffic to servers of a domain. A global server load balancing (GSLB) switch provides load balancing to the servers, and is configured with the GSLB host-level policies. Users can define a host-level policy (alternatively or additionally to a globally applied GSLB policy) and apply the host-level policy to hosts in domains configured on the GSLB switch. Thus, the user can enable different policies for different hosts. This allows the user to have the flexibility to control metrics used for selection of a best address for querying clients, as well as the metric order and additional parameters used in the GSLB process, at the host level.

Abstract: A switch may be used to force the expiration of a cookie on a user's system by inserting an expiration field into the cookie contained in a network response packet. Additionally, a mechanism is provided to delete or damage a cookie contained in a network request packet, so that server software is not disrupted by the receipt of a cookie. Deleting a cookie results in a cleaner request, but damaging a cookie may be more efficient in certain circumstances. By providing these features, an efficient cookie switching design is provided.

Abstract: Methods for efficiently managing a ternary content-addressable memory (TCAM) by minimizing movements of TCAM entries include determining a first node and a second node in the TCAM, determining if there is a free TCAM entry between the first node and the second node, and storing the new entry in the free TCAM entry. Upon determining that a free TCAM entry does not exist between the first node and the second node, further determining a chain of nodes and then determining if there is a free TCAM entry in the chain of nodes. Upon determining that there is a free TCAM entry within the chain of nodes, moving the TCAM entries identified as the nodes in the chain of nodes to generate a free node nearest to the new entry and inserting the new entry in the free node. Moving the TCAM entries identified as the nodes in the chain of nodes preserves the order of the nodes.

Abstract: File system disaster recovery techniques provide automated monitoring, failure detection and multi-step failover from a primary designated target to one of a designated group of secondary designated targets. Secondary designated targets may be prioritized so that failover occurs in a prescribed sequence. Replication of information between the primary designated target and the secondary designated targets allows failover in a manner that maximizes continuity of operation. In addition, user-specified actions may be initiated on failure detection and/or on failover operations and/or on failback operations.

Abstract: A method of configuring a stack includes: connecting stacking ports of a plurality of stackable devices using one or more stacking links; connecting a user console to a first one of the stackable devices; transmitting a stack setup command from the user console to the first stackable device; and establishing a stack in response to the stack setup command. The stack is established by initiating a discovery process with the first stackable device in response to the stack setup command, wherein the first stackable device requests and receives identifying information from the stackable devices over the stacking links during the discovery process. The topology of the stackable devices is displayed with the user console in response to the identifying information. The stackable devices are authenticated during the discovery process such that the stack setup is secure. The first stackable device becomes the active controller of the stack by default.

Abstract: A system and method for converting low-jitter, interleaved frame traffic, such as that generated in an IP network, to high jitter traffic to improve the utilization of bandwidth on arbitrated loops such as Fibre Channel Arbitrated Loops. Embodiments of a high jitter scheduling algorithm may be used in devices such as network switches that interface an arbitrated loop with an IP network that carries low-jitter traffic. The high jitter algorithm may use a separate queue for each device on the arbitrated loop, or alternatively may use one queue for two or more devices. Incoming frames are distributed among the queues based upon each frame's destination device. The scheduling algorithm may then service the queues and forward queued frames to the devices from the queues. In one embodiment, the queues are serviced in a round-robin fashion. In one embodiment, each queue may be serviced for a programmed limit.

Abstract: Solutions are provided that allow a network device to apply flow control on the MAC layer while taking into account the priority of the frame of traffic. This may be accomplished by generating a frame indicating that traffic flow should be paused, while utilizing a new opcode value, or alternatively by utilizing a new type/length value (possibly combined with a new opcode value). A receiving device may then examine the fields of the frame to determine whether it should it should use priority-based pausing, and then examine other fields to determine which priority-levels to pause and for how long. This allows for improved efficiency in flow control at the MAC layer. Additionally, the tagged pause frames can be forwarded over multiple hops on Local Area Networks across a Metropolitan Area Network or Wide Area Network.

Abstract: A routing system utilizes a layer 2 switch interconnecting several routers to intelligently forward multicast packets throughout an interne exchange carrying multicast content. The layer 2 switch performs protocol snooping to extract a lookup key that is based on network layer protocol information. The lookup key is uniquely formulated to support either shared or explicit source distribution trees. The lookup key is used to query a forwarding memory that returns an outgoing port index. The outgoing port index points to one or more outgoing ports that are eligible to receive the multicast packet. The outgoing ports are also connected to the neighboring device(s) that are designated to receive the multicast packet. The routing system also supports real time maintenance and updating of the forwarding memory based on the periodic exchange of control messages. The routing system is configured to support PIM routers operating in PIM SM or PIM SSM modes.

Abstract: Each service in a computer network may have a connection rate limit. The number of new connections per time period may be limited by using a series of rules. In a specific embodiment of the present invention, a counter is increased each time a server is selected to handle a connection request. For each service, connections coming in are tracked. Therefore, the source of connection-request packets need not be examined. Only the destination service is important. This saves significant time in the examination of the incoming requests. Each service may have its own set of rules to best handle the new traffic for its particular situation. For server load balancing, a reset may be sent to the source address of the new connection request. For transparent cache switching, the connection request may be forwarded to the Internet.

Abstract: The invention relates to methods and associated systems for displaying network fabric data for managing electronic networks, such as computer networks, storage area networks (SANs), and the like. In one aspect, the invention provides a method for displaying parameters of a plurality of devices in a network for comparison, where each device has a plurality of parameters, including determining and storing values for a plurality of parameters for each of a plurality of devices, and displaying a table of said stored parameter values, where the parameters form a first dimension of the table and the devices form a second dimension of the table. As an example, methods may further include determining if values for a common parameter among devices are identical, and displaying the table without the parameter if all the values for the parameter are identical.

Abstract: A server instance, which is a collection of LUNs, containing an operating system, any applications and data storage. A processing element is the physical hardware. The combination is a server as normally understood. Templates are used to define server instances and server types to simplify deploying a server instance to a processing element. A graphical user interface provides the templates where the particular storage groups are identified and then server instances are created from lists of operating systems, applications, and available storage. The management service processor is a PXE server and provides the necessary software to identify the components of the processing element and correlate between the processing element and a server instance. The management service processor then automatically provides software to the processing element to allow it correctly boot. The management service processor manages the interconnection of the processing element and the relevant LUNs.

Abstract: A switch may be used to force the expiration of a cookie on a user's system by inserting an expiration field into the cookie contained in a network response packet. Additionally, a mechanism is provided to delete or damage a cookie contained in a network request packet, so that server software is not disrupted by the receipt of a cookie. Deleting a cookie results in a cleaner request, but damaging a cookie may be more efficient in certain circumstances. By providing these features, an efficient cookie switching design is provided.

Abstract: A multiple key, multiple tiered network security system, method and apparatus provides at least three levels of security. The first level of security includes physical (MAC) address authentication of a user device being attached to the network, such as a user device being attached to a port of a network access device. The second level includes authentication of the user of the user device, such as user authentication in accordance with the IEEE 802.1x standard. The third level includes dynamic assignment of a user policy to the port based on the identity of the user, wherein the user policy is used to selectively control access to the port. The user policy may identify or include an access control list (ACL) or MAC address filter. Also, the user policy is not dynamically assigned if insufficient system resources are available to do so. Failure to pass a lower security level results in a denial of access to subsequent levels of authentication.

Abstract: A Fibre Channel router used to join fabrics. EX_ports are used to connect to the fabrics. The EX_port joins the fabric but the router will not merge into the fabric. Ports in the Fibre Channel router can be in a fabric, but other ports can be connected to other fabrics. Fibre Channel routers can be interconnected using a backbone fabric. Global, interfabric and encapsulation headers are developed to allow routing by conventional Fibre Channel switch devices in the backbone fabric and simplify Fibre Channel router routing. Phantom domains and devices must be developed for each of the fabrics being interconnected. Front phantom domains are present at each port directly connected to a fabric. Each of these is then connected to at least one translate phantom domain. Zoning is accomplished by use of a special LSAN zoning naming convention. This allows each administrator to independently define devices are accessible.

Abstract: Dynamic rate limiting adjustment may be provided by sampling actual output rates from a rate limited device and utilizing this information to modify configured traffic limits. This allows the device to achieve actual output rates much closer to the desired rate limits for users and services.