Abstract: A system and method that provides for copying ARP replies, and generating data packets which include the ARP reply, and other information such as an identification of the port on the ARP reply was received. These data packets are then transmitted to an ARP collector which stores the ARP reply and port information. The ARP collector then uses this stored information, and analyzes future data packets relative to the stored information to detect occurrences of ARP spoofing. The ARP collector further provides for generating alerts and taking security actions when ARP reply spoofing is detected.

Abstract: A backplane interface adapter with error control and redundant fabric for a high-performance network switch. The error control may be provided by an administrative module that includes a level monitor, a stripe synchronization error detector, a flow controller, and a control character presence tracker. The redundant fabric transceiver of the backplane interface adapter improves the adapter's ability to properly and consistently receive narrow input cells carrying packets of data and output wide striped cells to a switching fabric.

Abstract: A rackmount chassis includes removable supports that provide interior support for blades having mounting edge-to-mounting edge dimensions that are less than the full chassis width. The removable supports are mounted on parallel support plates that span the full width of the chassis. Each removable support supports an edge of at least one blade installed into the rackmount chassis. The locations of the removable supports on the parallel support plates determine the blade form factors (mounting edge-to-mounting edge dimensions) that the rackmount chassis can accept. Because the removable supports can be individually removed/installed, the configuration of the resulting rackmount component can be changed without physically removing the rackmount component from the rack in which it is mounted.

Abstract: Multicast capability in a virtual private LAN service (VPLS) is provided in a provider IP/MPLS infrastructure without headend replications by encapsulating a customer data packet to use an established multicast protocol, such as IP multicast. In one example, the customer data packet is encapsulated by an IP header having an IP multicast group address and an Ethernet header. In one implementation, a DNS type mechanism is provided to distribute the IP multicast addresses for VPLS use. Such IP multicast group address can be set aside from an administratively scoped address range. An efficient IP routing algorithm running on the provider's network provides an efficient distribution tree for routing IP-encapsulated customer packet for the VPLS.

Abstract: Techniques for configuring a local repair connection for a protected connection including determining a path for the local repair connection. The path traversed by a local repair connection starts at a node in the path associated with the protected connection and ends at a merge point node in the path associated with the protected connection that is downstream from the start node. In one embodiment, the merge point node may even be more than two hops downstream from the start node in the path associated with the protected connection. The local repair path may include zero or more nodes that are not included in the path associated with the protected connection. Techniques are also described for optimizing the path associated with a local repair connection.

Abstract: The method of the present invention comprises initiating a connection to a port on an access device by a supplicant and associating supplicant identification information with the port. The access device may comprise any network connectivity device, including a wireless access point. Data packets transmitted over the port by the supplicant are statistically sampled as they are transmitted, with each of the sample data packets also associated with the supplicant identification information. The sample data packets are stored according to their associated supplicant identification information in order to perform accounting. The sample data packets, with the supplicant identification information, are sent to a network management system where the data is archived and presented in a human readable form, e.g., charts, etc.

Abstract: A Voice over Internet Protocol (VoIP) network is described in which session state is maintained in access switches, but not signaling gateways which maintain transaction state only during pendency of a related transaction. The signaling gateway further provides transparent inter-operation between the VoIP network and non-IP networks, such as the PSTN, by means of a translator which directly translates messages between the networks.

Abstract: Embodiments of the present invention provide techniques for efficient generation of CRC values in a network environment. Specific embodiments of the present invention enable CRC processing circuits that can generate CRC values at high data throughput rates (e.g., 100 Gbps or greater), while being capable of being implemented on currently available FPGAs. Accordingly, embodiments of the present invention may be used in network devices such as routers, switches, hubs, host network interfaces and the like to support high speed data transmission standards such as 100G Ethernet and beyond.

Abstract: A virtual router spans a number of physical routing devices. One of the physical routing devices is designated as master, and the other physical routing devices are designated as backups to the master. The virtual router may be situated between a first local area network and a second local area network. A virtual router identifier can be associated with multiple interfaces on each of the physical routing devices.

Abstract: A processor (e.g. utilizing an operating system and/or circuitry) may access physical memory by paging, where a page is the smallest partition of memory mapped by the processor from a virtual address to a physical address. An application program executing on the processor addresses a virtual address space so that the application program may be unaware of physical memory paging mechanisms. A memory control layer manages physical memory space in units of sub-blocks, wherein a sub-blocks is smaller than a size of the page. Multiple virtual address blocks may be mapped to the same physical page in memory. A sub-block can be moved from a page (e.g. from one physical memory to a second physical memory) without moving other sub-blocks within the page in a manner that is transparent to the application program.

Abstract: A system and method that provides for copying ARP replies, and generating data packets which include the ARP reply, and other information such as an identification of the port on the ARP reply was received. These data packets are then transmitted to an ARP collector which stores the ARP reply and port information. The ARP collector then uses this stored information, and analyzes future data packets relative to the stored information to detect occurrences of ARP spoofing. The ARP collector further provides for generating alerts and taking security actions when ARP reply spoofing is detected.

Abstract: A method of allocating power to ports in an Ethernet switch, including: (1) determining the available capacity of a power pool used to supply the ports, (2) assigning a configuration power to each of the ports, (3) selecting a port to be enabled, (4) determining whether the available capacity of the power pool exceeds the configuration power assigned to the selected port, and, if the available capacity of the power pool exceeds the configuration power assigned to the selected port, then (4) subtracting the configuration power assigned to the selected port from the available capacity of the power pool, (5) enabling and powering the selected port and simultaneously detecting whether the selected port is connected to a powered device, and (6) adding the configuration power assigned to the selected port to the available capacity of the power pool if the port is not connected to a powered device.

Abstract: In a load balancing system, user-configurable geographic prefixes are provided. IP address prefix allocations provided by the Internet Assigned Numbers Authority (IANA) and associated geographic locations are stored in a first, static database in a load balancing switch, along with other possible default geographic location settings. A second, non-static database stores user-configured geographic settings. In particular, the second database stores Internet Protocol (IP) address prefixes and user-specified geographic regions for those prefixes. The specified geographic region can be continent, country, state, city, or other user-defined region. The geographic settings in the second database can override the information in the first database. These geographic entries help determine the geographic location of a client and host IP addresses, and aid in directing the client to a host server that is geographically the closest to that client.

Abstract: Solutions are provided that allow a network device to apply flow control on the MAC layer while taking into account the priority of the frame of traffic. This may be accomplished by generating a frame indicating that traffic flow should be paused, while utilizing a new opcode value, or alternatively by utilizing a new type/length value (possibly combined with a new opcode value). A receiving device may then examine the fields of the frame to determine whether it should use priority-based pausing, and then examine other fields to determine which priority-levels to pause and for how long. This allows for improved efficiency in flow control on the MAC layer.

Abstract: Dynamic rate limiting adjustment may be provided by sampling actual output rates from a rate limited device and utilizing this information to modify configured traffic limits. This allows the device to achieve actual output rates much closer to the desired rate limits for users and services.

Abstract: A backplane interface adapter for a network switch. The backplane interface adapter includes at least one receiver that receives input cells carrying packets of data; at least one cell generator that generates encoded cells which include the packets of data from the input cells; and at least one transmitter that transmits the generated cells to a switching fabric. The cell includes a destination slot identifier that identifies a slot of the switching fabric towards which the respective input cell is being sent. The generated cells include in-band control information.

Abstract: Techniques that assist in processing of failure detection protocol (FDP) packets. Techniques are provided that assist a CPU of a network device in processing incoming FDP packets. In one embodiment, a module is provided in a network device for detecting and flagging the non-receipt of FDP packets by the network device for one or more FDP sessions. In this manner, the task of detecting non-receipt of FDP packets is offloaded from the CPU of the network device. This enables the network device to support newer FDPs with shorter periodic interval requirements.

Abstract: A system and method that provides for using source IP addresses and MAC addresses in a network to provide security against attempts by users of the network to use false source IP addresses in data packets. The system and method provide for analyzing MAC addresses and source IP addresses at the datalink (layer 2) level, and to use the information derived from such analysis to block access through a port where a host device is using a false, or spoofed, source IP address in transmitted data packets.

Abstract: An embodiment includes a method of minimizing the delay in convergence time for a complex STP topology following a topology change in the network system in the spanning tree protocol (STP) standard, including: receiving, by a root port of a first bridge, a data message that includes identification of a current root bridge and a priority value of the current root bridge; receiving, by a second port of the first bridge, a second data message from a second bridge; and if a message age timer of the first bridge has less than a limiting message age time value remaining before expiry, then blocking a reply, by the second port of the first bridge, to the second data message from the second bridge.

Abstract: The number of content addressable memory (CAM) lookups is reduced from two to one. Each side (left and right sides) of a CAM is programmed with network addresses, such as IP addresses, based on certain bits of the network addresses. These bits of the network addresses (which represent packet routes) are examined and used to determine whether the particular network address is to be placed on the left or right sides of the CAM. The grouping of certain network addresses either on the left or right sides of the CAM can be performed by examining an individual bit of each network address, by performing an exclusive OR (XOR) operation on a plurality of bits of each network address, and/or by searching for bit patterns of the network address in a decision table. Network addresses that cannot be readily assigned to a particular side of the CAM using these grouping techniques are programmed into both sides of the CAM.