Abstract: Techniques that offer enhanced diversity in the selection of paths (e.g., ECMP paths) and/or ports from ports associated with trunks for forwarding data traffic. In one embodiment, one or more functions are used to generate a result. A first portion of the generated result may be used as an index (e.g., ECMP index) for selecting a path (e.g., an ECMP path) from multiple possible paths for forwarding a packet. A second portion of the generated result, different from the first portion, may be used as an index (trunk index) for selecting an output port from multiple output ports associated with a trunk for forwarding a packet. In this manner, selected portions of the generated result may be used as indices, one for selecting a path and another for selecting a trunk port for forwarding packets such that the two indices are not the same and are not dependent upon one another.

Abstract: Techniques for incrementing counters in an efficient manner. In one set of embodiments, counter logic circuits are provided that can operate at higher frequencies than existing counter logic circuits, while being capable of being implemented in currently available field programmable gate arrays (FPGAs) or fabricated using currently available process technologies. The counter logic circuits of the present invention may be used to increment statistics counters in network devices that support line speeds of 40 Gbps, 100 Gbps, and greater.

Abstract: Techniques for efficiently performing division and modulo operations in a programmable logic device. In one set of embodiments, the division and modulo operations are synthesized as one or more alternative arithmetic operations, such as multiplication and/or subtraction operations. The alternative arithmetic operations are then implemented using dedicated digital signal processing (DSP) resources, rather than non-dedicated logic resources, resident on a programmable logic device. In one embodiment, the programmable logic device is a field-programmable gate array (FPGA), and the dedicated DSP resources are pre-fabricated on the FPGA. Embodiments of the present invention may be used in Ethernet-based network devices to support the high-speed packet processing necessary for 100G Ethernet, 32-port (or greater) trunking, 32-port/path (or greater) load balancing (such as 32-path ECMP), and the like.

Abstract: The real-time aspects of keep-alive generation are removed from the dynamic routing protocol (DRP) application and are embedded within a Unix-based operating system, which is programmed by DRP. A keep-alive control provides the ability to create a keep-alive message and a timeout interval on a TCP socket. Each socket can have an independent keep-alive message and timeout interval. A keep-alive message is sent whenever the TCP socket sends no normal user output for a duration exceeding the timeout interval. A timeout interval is normally specific in seconds and a keep-alive message is user definable and must not exceed a predetermined length in bytes. System calls are used to set the timeout interval and keep-alive message independently. Both a timeout and a keep-alive message must be set before the timeout becomes active.

Abstract: To secure an access provider, communications to/from the access provider are monitored for a partially-completed connection transaction. Detected partially-completed connection transactions are terminated when they remain in existence for a period of time that exceeds a threshold period of time. The monitoring may include detecting partially-completed connection transactions initiated by an access requestor, measuring the period of time that a partially-completed connection transaction remains in existence, comparing the period of time with the threshold period of time, and resetting a communication port located on the access provider.

Abstract: To secure an access provider, communications to/from the access provider are monitored for a partially-completed connection transaction. Detected partially-completed connection transactions are terminated when they remain in existence for a period of time that exceeds a threshold period of time. The monitoring may include detecting partially-completed connection transactions initiated by an access requestor, measuring the period of time that a partially-completed connection transaction remains in existence, comparing the period of time with the threshold period of time, and resetting a communication port located on the access provider.

Abstract: A user interface engine may be created that uses a descriptive language to describe the user interface fields, the corresponding device properties, and other layout attributes. This information may be stored in description file. The user interface engine may then read in this description file, render the user interface, and generate device property value payload. Then the payload may be deployed to target devices. This allows a network management application to be modified without requiring user interface code or data structure classes to be written or changed.

Abstract: A host router is logically partitioned into virtual router domains that manage independent processes and routing application copies but share a common operating system. Each v-net manages an independent set of sockets and host router interfaces, each associated with only one v-net at one time, but interchangeably repartitionable. Traffic is removed from an interface during repartitioning. Duplicate arrays of global variables copied to each v-net are accessed by macro references. A v-net facility can separate route tables used internally from the externally visible route tables and can avoid conflicts between internal and external IP addresses that share the same identifier. For example a common FreeBSD operating system supports a dynamic routing protocol (DRP) application. Each v-net runs an independent copy of the DRP software and is logically independent. A failure in one DRP copy does not adversely affect other copies.

Abstract: A backplane interface adapter with error control and redundant fabric for a high-performance network switch. The error control may be provided by an administrative module that includes a level monitor, a stripe synchronization error detector, a flow controller, and a control character presence tracker. The redundant fabric transceiver of the backplane interface adapter improves the adapter's ability to properly and consistently receive narrow input cells carrying packets of data and output wide striped cells to a switching fabric.

Abstract: In a multi-QOS level queuing structure, packet payload pointers are stored in multiple queues and packet payloads in a common memory pool. Algorithms control the drop probability of packets entering the queuing structure. Instantaneous drop probabilities are obtained by comparing measured instantaneous queue size with calculated minimum and maximum queue sizes. Non-utilized common memory space is allocated simultaneously to all queues. Time averaged drop probabilities follow a traditional Weighted Random Early Discard mechanism. Algorithms are adapted to a multi-level QOS structure, floating point format, and hardware implementation. Packet flow from a router egress queuing structure into a single egress port tributary is controlled by an arbitration algorithm using a rate metering mechanism. The queuing structure is replicated for each egress tributary in the router system.

Abstract: A switching device comprising one or more processors coupled to a media access control (MAC) interface and a memory structure for switching packets rapidly between one or more source devices and one or more destination devices. Packets are pipelined through a series of first processing segments to perform a plurality of first sub-operations involving the initial processing of packets received from source devices to be buffered in the memory structure. Packets are pipelined through a series of second processing segments to perform a plurality of second sub-operations involved in retrieving packets from the memory structure and preparing packets for transmission. Packets are pipelined through a series of third processing segments to perform a plurality of third sub-operations involved in scheduling transmission of packets to the MAC interface for transmission to one or more destination devices.

Abstract: A system and method that provides for protection of a CPU of a router, by establishing a management port on a router. Hosts which are connected to a non-management ports of the router are denied access to management functions of a CPU of the router. The system and method can utilize an application specific integrated circuit, in conjunction with a CAM-ACL, which analyzes data packets received on the ports of router, and the ASIC operates to drop data packets which are directed to the CPU of the router. This system and method operates to filter data packets which may be generated in attempts to hack in to control functions of a network device, and the operation does not require that the CPU analyze all received data packets in connection with determining access to the control functions of the router.

Abstract: In a load balancing system, user-configurable geographic prefixes are provided. IP address prefix allocations provided by the Internet Assigned Numbers Authority (IANA) and associated geographic locations are stored in a first, static database in a load balancing switch, along with other possible default geographic location settings. A second, non-static database stores user-configured geographic settings. In particular, the second database stores Internet Protocol (IP) address prefixes and user-specified geographic regions for those prefixes. The specified geographic region can be continent, country, state, city, or other user-defined region. The geographic settings in the second database can override the information in the first database. These geographic entries help determine the geographic location of a client and host IP addresses, and aid in directing the client to a host server that is geographically the closest to that client.

Abstract: An Ethernet switch includes 12-Volt and 48-Volt power sourcing modules, system software, Ethernet interface modules and optional power over Ethernet (PoE) modules. The Ethernet interface modules are motherboards that include the circuitry required to implement a non-PoE system. The PoE modules are daughter boards that include the circuitry required to supply powered devices in a PoE subsystem. A PoE module may be connected to a corresponding Ethernet interface module. During start up, all of the Ethernet interface modules are first powered up in response to the 12-Volt power sourcing module. If the system software subsequently determines that the 48-Volt power sourcing module is operational, then (and only then) the system software attempts to detect the presence of any PoE modules. Upon detecting one or more PoE modules, the PoE modules are initialized and configured, thereby enabling PoE operation.

Abstract: A global server load balancing (GSLB) switch serves as a proxy to an authoritative DNS communicates with numerous site switches which are coupled to host servers serving specific applications. The GSLB switch receives from site switches operational information regarding host servers within the site switches neighborhood. When a client program requests a resolution of a host name, the GSLB switch, acting as a proxy of an authoritative DNS, returns one or more ordered IP addresses for the host name. The IP addresses are ordered using metrics that include the information collected from the site switches. In one instance, the GSLB switch places the address that is deemed “best” at the top of the list.

Abstract: In a multi-QOS level queuing structure, packet payload pointers are stored in multiple queues and packet payloads in a common memory pool. Algorithms control the drop probability of packets entering the queuing structure. Instantaneous drop probabilities are obtained by comparing measured instantaneous queue size with calculated minimum and maximum queue sizes. Non-utilized common memory space is allocated simultaneously to all queues. Time averaged drop probabilities follow a traditional Weighted Random Early Discard mechanism. Algorithms are adapted to a multi-level QOS structure, floating point format, and hardware implementation. Packet flow from a router egress queuing structure into a single egress port tributary is controlled by an arbitration algorithm using a rate metering mechanism. The queuing structure is replicated for each egress tributary in the router system.

Abstract: A switching device comprising one or more processors coupled to a media access control (MAC) interface and a memory structure for switching packets rapidly between one or more source devices and one or more destination devices. Packets are pipelined through a series of first processing segments to perform a plurality of first sub-operations involving the initial processing of packets received from source devices to be buffered in the memory structure. Packets are pipelined through a series of second processing segments to perform a plurality of second sub-operations involved in retrieving packets from the memory structure and preparing packets for transmission. Packets are pipelined through a series of third processing segments to perform a plurality of third sub-operations involved in scheduling transmission of packets to the MAC interface for transmission to one or more destination devices.

Abstract: A technique to load balance network packet traffic using content switching is provided. Packets are routed to a particular server or otherwise processed based on the HTTP header content of the packets. In an embodiment, the HTTP header contents of the packets are used in such processing. Content switching decisions are based on any field in the HTTP header, including both known and unknown fields. A plurality of content switching policies is provided. A policy includes a set of rules and actions associated with these rules. Complex nested rules are defined. The evaluation of these nested rules is simplified by converting the nested rules in to their sum of products or minterm representations, and then a bit mask technique is used in conjunction with the minterm representations to determine which set of complex rules in a policy is valid and thus require the corresponding content switching action.

Abstract: Stateful failover redundancy support is provided for network address translation (NAT). A master NAT device is backed-up with at least one back-up NAT device. Existing sessions are synchronized between the two NAT devices, such as via a dedicated link between them. In the event of a failover where the master NAT device is unable to perform its NAT functions, ownership of Internet protocol (IP) addresses is transferred from the master NAT device to the back-up NAT device. The back-up NAT device, which is now owner of the IP addresses, assumes the NAT functionality associated with these IP addresses and continues the existing sessions, as well as processing new sessions.

Abstract: The system of the present invention provides data transmission speeds at or in excess of 10 gigabits per second between one or more source devices and one or more destination devices. The system comprises a media access control (MAC) interface to facilitate receipt and transmission of packets over a physical interface. A first field programmable gate array is coupled to the MAC interface and operative to receive packets from the MAC interface and configured to perform initial processing of packets, which are dispatched to a first memory. A second field programmable gate array is operative to retrieve packets from the first memory and configured to compute an appropriate destination, which is used to dispatch packets to a backplane. A third field programmable gate array is provided that is operative to receive packets from the backplane and configured to organize the packets for transmission, which are dispatched to a second memory.