Abstract: A method and system is provided to enable quality of service across a backplane switch for multicast packets. For multicast traffic, an egress queue manager manages congestion control in accordance with multicast scheduling flags. A multicast scheduling flag is associated with each egress queue capable of receiving a packet from a multicast ingress queue. When the multicast scheduling flag is set and the congested egress queue is an outer queue, the egress queue manager refrains from dequeueing any marked multicast packets to the destination ports associated with the congested outer queue until the congestion subsides. When the congested egress queue is a backplane queue, the egress queue manager refrains from dequeuing any marked multicast packets to the destination ports on the destination blade associated with the congested backplane queue until the congestion subsides.

Abstract: Systems, mechanisms, apparatuses, and methods are disclosed for forwarding Inter-Switch Connection (ISC) frames in a Network-to-Network Interconnect (NNI) topology, for example, via a network switch which includes a first physical switch port to receive a physical switch link from a second network switch; logic to implement a first logical ISC and a second logical ISC? connection to the second network switch via the physical switch link; a second physical switch port to receive an interface connection from a third network switch; and switch forwarding logic to forward frames received at the first network switch to the second network switch via the logical ISC or logical ISC? based on whether or not the physical switch link is part of an active topology upon which the network switch operates or is not part of the active topology upon which the network switch operates. Other embodiments are disclosed.

Abstract: Systems, mechanisms, apparatuses, and methods are disclosed for forwarding Inter-Switch Connection (ISC) frames in a Network-to-Network Interconnect (NNI) topology, for example, via a network switch which includes a first and second physical switch port to receive a first and second physical switch link from a second network switch; logic to implement first and second logical ISC? connections to the second switch via the first and second physical switch links respectively; logic to implement a Primary Forwarder which is interfaced with a Secondary Forwarder in the second switch via the first logical ISC? connection; logic to implement a Secondary Forwarder which is interfaced with a Primary Forwarder in the second switch via the second logical ISC? connection; and switch forwarding logic to forward frames based on which connection the frames are received by, and/or based on a gateway identifier associated with each received frame. Other embodiments are disclosed.

Abstract: A network switch automatically detects undesired network traffic and mirrors the undesired traffic to a security management device. The security management device determines the source of the undesired traffic and redirects traffic from the source to itself. The security management device also automatically sends a policy to a switch to block traffic from the source.

Abstract: A method of presenting different virtual routers to different end users, classes of service, or packets is provided. An incoming packet is received having a VLAN field and at least one additional field. A key is formed from the VLAN field and at least one other packet field, and mapped into a virtual router identifier (VRID) using an indirection mapping process. The VRID identifies a particular virtual router configuration from a plurality of possible virtual router configurations. A networking device is configured to have the particular virtual router configuration identified by the VRID, and the packet is then forwarded by the configured device.

Abstract: The subject matter described herein includes methods and systems for conserving multicast port lists in an IP packet forwarding device. According to one embodiment, the method includes providing an IP multicast packet port data structure containing at least a first port list and a second port list. The first and second port lists each contain zero or more port addresses for indicating the ports to which a received IP multicast packet including a group IP address is to be forwarded. An IP multicast packet forwarding database (FDB) is provided where the FDB has at least a first FDB entry and a second FDB entry for forwarding the received IP multicast packet based on its group IP address. The first and second FDB entries each include at least one multicast group IP address and are associated with at least one of the first and the second port lists. It is then determined whether the first and second port lists contain identical information.

Abstract: A backplane device to connect to a plurality of stackable network switch devices. According to one aspect of the intention, each of the plurality of stackable network switch devices can implement its own internal non-blocking switching. According to another aspect of the intention, the relative configuration of connectors and signal lines of the backplane device provide for a switch device to be readily connected into (or disconnected from) a switch stack implementing combined non-blocking switching.

Abstract: The subject matter described herein includes methods and systems for dynamically rate limiting slowpath processing of exception packets. According to one embodiment, a method includes monitoring processing resources in a packet forwarding device used for performing slowpath processing of exception packets at the packet forwarding device. It is determined whether usage of the processing resources used for slowpath processing exceeds a first threshold and, in response to determining that the processing resources exceed the first threshold, rate limiting the slowpath processing of the exception packets.

Abstract: A programmable processor configured to perform one or more packet modifications through execution of one or more commands. A pipelined processor core comprises a first stage configured to selectively shift and mask data in each of a plurality of categories in response to one or more decoded commands, and combine the selectively shifted and masked data in each of the categories. The pipelined processor core further comprises a second stage configured to selectively perform one or more operations on the combined data from the first stage and other data responsive to the one or more decoded commands. In one implementation, the processor is implemented as an application specific integrated circuit (ASIC).

Abstract: Forwarding database entries in a memory of a network device are scanned. Each port on the network device maintains a forwarding database in the memory. A filtered list of forwarding database entries is automatically sent to a management module.

Abstract: In response to a network topology change, packets are initially flooded on ports of a network device. In addition, a bit array is cleared in response to the topology change. Each bit in the bit array is associated with a particular forwarding entry on the network device. In connection with the clearing of the bit array, the flooding of packets on ports of the network device is made conditional, reducing failover time of the network.

Abstract: Packet modification is performed in the switch fabric by selecting a conditional command belonging to a set of commands for modifying a packet. The set of commands is identified based on an index value, and selecting a conditional command belonging to the set of commands is based on a mask value, where the index and mask values are determined based on data in the packet undergoing modification, such as the packet's source and destination, or incoming label. Among other advantages, controlling packet modification in the switch fabric through selecting a conditional command belonging to a set of commands allows multiple sets of commands to be replaced with a single set of commands, resulting in a more efficient use of available external memory.

Abstract: A method for selectively redirecting a data packet to a port on a switching device which is associated with a corresponding network service. In one embodiment, the data packet is redirected to an intrusion prevention service (IPS) for security analysis of the data packet. In another embodiment, the switching device performs a data link layer redirecting of the data packet based at least in part on whether the data packet is to be flooded from the switching device.

Abstract: A network switch detects at least two simultaneous connections on a single network port. The simultaneous connections use different protocols despite using the same port. The network switch mirrors network traffic associated with the simultaneous connections to a security management device on the network. The security management device then determines a source or destination of the network traffic.

Abstract: The subject matter described herein includes methods and systems for providing accidental stack join protection. According to one embodiment, a method includes connecting stacking ports of a first switch that is a member of a first stack and a second switch that is a member of a second stack and thereby joining the first and second stacks. The configurations of the first stack and of the second stack are detected and it is determined whether the detected configurations indicate a configuration mismatch between the first and second stacks. In response to determining that the detected configurations relate to a mismatch, the automatic joining of the first and second stacks is inhibited and the first and second stacks are allowed to continue switching traffic with their existing configurations.

Abstract: A ring network with an automatic protection switching domain includes a control VLAN and at least one data VLAN. A master node in the ring is connected to at least one transit node. Each node in the ring network is linked to an adjacent node by a primary port or a secondary port. The master node receives notification of a fault via the control VLAN, the fault indicating a failed link between adjacent nodes. In response, the master node unblocks its secondary port to traffic on the data VLAN(s). The forwarding database entries on the master node and on the transit node(s) are flushed. Data traffic is flooded to the ring network until forwarding database entries on the master node and on the transit node(s) have been reestablished.

Abstract: Several systems for supporting packet processing are described. A first system supports virtual routing of a packet. A second system supports de-multiplexing of a packet. A third system supports advanced MPLS label processing of a packet.

Abstract: Methods, systems, and computer program products for controlling enqueuing of packets in an aggregated queue including a plurality of virtual queues are disclosed. According to one method, packets are received at the input side of a queuing system. Each packet is classified into a virtual queue corresponding to one of a plurality of output queues. The output queue sends backpressure messages to the enqueue controller. The enqueue controller determines whether to place the packets in the aggregated queue based on the backpressure messages.

Abstract: An indication of a host route to be added to a forwarding database table as an entry is received. The host route is added to a first hardware table or a second hardware table if a space is available in the second hardware table or in a first storage area of the first hardware table. The first hardware table has both a first storage area and a second storage area. If a space is not available in the second hardware table or the first storage area of the first hardware table, the first storage area of the first hardware table is automatically expanded to include unused space in the second storage area of the first hardware table. The host route is then added to a space in the expanded first storage area of the first hardware table.

Abstract: A method and system for enforcing host routing settings in a network device comprises network devices having enforcement logic for extracting host routing settings from a DHCP packet issued by a DHCP server to a DHCP client connecting to a network. The network devices generate enforcement rules based on the host routing settings and apply those rules to ports through which the DHCP client connects to the network. The enforcement rules include access control lists having one or more match conditions generated based on the host routing settings.