Abstract: In some embodiments, an apparatus includes a printed circuit board and a thermal interface member. The printed circuit board is configured to be coupled to an electronic device, such as, for example, a removable (or “pluggable”) optical transceiver. A first surface of the printed circuit board includes a thermally-conductive portion, and a second surface of the printed circuit board includes a thermally-conductive portion that is coupled to the thermally-conductive portion of the first surface by a thermally-conductive via between the first surface and the second surface. The thermal interface member is coupled to the first surface of the printed circuit board such that a portion of the thermal interface member is in contact with the thermally-conductive portion of the first surface. The portion of the thermal interface member is deformable and thermally-conductive.

Abstract: A portable, self-powered, interface converter for converting between Ethernet over twisted pair cables and Ethernet over optical fiber is described. In one implementation, the device may include a first interface to a power-over-Ethernet connection and a second interface to provide a connection to receive fiber optic cabling. A power-over-Ethernet (PoE) circuit may derive power from the PoE connection and output a corresponding power signal. A transcoder may perform physical layer conversion between Ethernet communications over twisted pair cabling connected to the first interface and Ethernet communications over the fiber optic cabling. The transcoder may be powered by the power signal output by the PoE circuit.

Abstract: A network device receives initial policer limits for a plurality of over-subscribing ingress ports, where the initial policer limits are based on existing bandwidth limits for an over-subscribed egress port associated with the over-subscribing ingress ports. The network device receives a high threshold watermark and a low threshold watermark for bandwidth usage of the over-subscribed egress port, and identifies a queue, associated with the over-subscribed egress port, with values outside the high threshold watermark or the low threshold watermark. The network device reduces the initial policer limits for the plurality of over-subscribing ingress ports when the queue has values above the high threshold watermark, and increases the initial policer limits for the plurality of over-subscribing ingress ports when the queue has values below the low threshold watermark.

Abstract: Graceful restart in routers having redundant routing facilities may be accomplished by replicating network (state/topology) information.

Abstract: A system may include receiving a packet, of a packet stream, including control tags in a header portion of the packet and classifying each of the control tags into a category selected from a set of possible categories. The set of possible categories may include an unambiguous interposable (UI) category that is assigned to a control tag that corresponds to an unambiguous parsing interpretation and that is interposable within a sequence of the control tags, and an ambiguous interposable (AI) category that is assigned to a control tag in which the control tag has an ambiguous parsing interpretation and in which the control tag is interposable within the sequence of the control tags. The method may further include determining parsing operations to perform for the packet based on the classified categories of the control tags and based on the packet stream of the packet.

Abstract: In general, techniques for facilitating a distributed network (L3) subnet by which multiple independent control planes of network devices connected to physically separate L2 networks provide L2 reachability to/from a single L3 subnet. In some examples, a shared L2 network physically situated to connect a plurality of physically separate L2 networks “stitches” the L2 networks together within the respective, independent control planes of switches such that the control planes bridge L2 traffic for a single bridge domain for the separate L2 networks to the shared L2 network and visa-versa. Each of the independent control planes may be configured with a virtual IRB instance associated with the bridge domain and with a common network subnet. Each of the virtual IRBs provides a functionally similar routing interface for the single bridge domain for the separate L2 networks and allows the shared network subnet to be distributed among the independent control planes.

Abstract: In general, techniques are described for programming a set of one or more pre-defined rules within the forwarding plane of a packet gateway of a mobile service provider network and caching, within control plane, a group identifier that identifies the set of programmed, pre-defined rules. The control plane may match quality of service (QoS) information of incoming subscriber service requests with the group identifier and respective subsets of the set of programmed, pre-defined rules to rapidly associate service requests with already-programmed PCC rules and thereafter install, to the forwarding plane, subscriber service-specific actions for the PCC rules.

Abstract: A network router dynamically reconfigures representations of forwarding structures used within a forwarding unit of the router. The forwarding structures comprise a plurality of forwarding next hops associated with the routes and stored in a first representation within the forwarding unit. The router further comprises a control unit having a processor to install the forwarding structures within the forwarding unit. In response to input directing the router to change from a first operating mode to a second operating mode, the control unit installs, within the forwarding unit, one or more new forwarding next hops that are associated with none of the routes by the forwarding structures and are stored in a second representation within the forwarding unit that is different from the first representation and, after installing the new forwarding next hop, updates the forwarding structures to associate at least one of the routes to the new forwarding next hop.

Abstract: A system discovers peer nodes in a failover system, establishes a secure channel between at least two of the peer nodes, and exchanges state information over the secure channel.

Abstract: A method may include receiving a communication from a client device and identifying a port number, a protocol and a destination associated with the communication. The method may also include identifying a first application being executed by the first client device based on the port number, the protocol and the destination associated with the first communication.

Abstract: In some embodiments, an apparatus includes a core network node configured to associate with a native multicast group a first client device that is associated with a first virtual local area network (VLAN) and operatively coupled to the core network node via a first access network node and an aggregation network node. The core network node can associate with the native multicast group a second client device that is associated with a second VLAN and operatively coupled to the core network node via a second access network node and the aggregation network node. The core network node can define a multicast VLAN including the first VLAN and the second VLAN based on the native multicast group. The core network node can receive a multicast data unit associated with the native multicast group and can also define a single instance of the multicast data unit for the multicast VLAN.

Abstract: A network device includes a first and a second control board, with each control board having a separate control plane and fabric plane. The network device is configured to establish an active control plane on the first control board and an active fabric plane on the second control board. The network device is configured to establish a standby fabric plane on the first control board and a standby control plane on the second control board. The network device is configured to detect a failure on the first control board or the second control board and switch the status of the control plane on the second control board from standby to active, when the failure is on the first control board, and switches the status of the fabric plane on the first control board from standby to active when the failure is on the second control board.

Abstract: In general, techniques are described for automated traffic mapping for multi-protocol label switching (MPLS) networks. A network device comprising a processor and an interface card may perform the techniques. The processor may generate an advertisement that conforms to a routing protocol. The advertisement may advertise a mapping between a network flow and a label switched path (LSP) tag. The processor may also generate a communication associating the label switched path tag with an LSP. The interface card may transmit the advertisement to a head-end label edge router that admits traffic into the LSP identified by the LSP tag. The interface card may also transmit the communication to the label edge router such that the label edge router is able to process the communication in conjunction with the advertisement to map the network flow to the LSP identified by the LSP tag.

Abstract: A computing device may receive content from a content source. The content may include software code that is executable by a web browser, and may be directed to another computing device. The computing device may inject security content into the content. The security content may include software instructions to enable the web browser to detect malicious software content within the content. The computing device may communicate the content to the other computing device.

Abstract: A device includes a security process unit (SPU) associated with a logical ring of SPUs. The SPU receives a packet with an address associated with a malicious source, and creates, based on the packet, an entry in a data structure associated with the SPU. The entry includes information associated with the packet. The SPU provides an install message to a next SPU in the logical ring. The install message instructs the next SPU to create the entry in another data structure, and forward the install message to another SPU. The SPU receives the install message from a last SPU, and sets a state of the entry to active in the data structure based on receiving the install message from the last SPU. The SPU performs a particular action on another packet, associated with the malicious source, based on the setting the state of the entry to active.

Abstract: A layer 2 transport network, and components thereof, supporting virtual network functionality among customer edge devices. Virtual private network configuration can be accomplished with merely local intervention by preprovisioning extra channel (or circuit) identifiers at each customer edge device and by advertising label base and range information corresponding to a list of channel (or circuit) identifiers.

Abstract: A system includes a device chassis and a base. The base includes a first section on a first side of the base, a second section on a second side of the base, and a middle section between the first section and the second section. The middle section is arranged above the first section and the second section. The device chassis attaches to the middle section, and a space is provided between the middle section and the device chassis.

Abstract: In some embodiments, an apparatus includes a first network control entity within a control plane of a switch fabric system. The first network control entity is configured to receive a first test signal including a test instruction to be implemented within the switch fabric system. The first network control entity is configured to send a second test signal including the test instruction to a second network control entity such that the second network control entity implements the test instruction for a predetermined amount of time.

Abstract: In some embodiments, a non-transitory processor-readable medium includes code to cause a processor to receive at a tunnel server, a data unit addressed to a communication device, and define, a first instance of the data unit and a second instance of the data unit. The first instance of the data unit is sent to the communication device via a first tunnel defined between at least the tunnel server and a first base station associated with a first network. The second instance of the data unit is sent to the communication device via a second tunnel defined between at least the tunnel server and a second base station associated with a second network. The second instance of the data unit is dropped by the communication device when the first instance of the data unit is received before the second instance of the data unit.

Abstract: A method of sending data to a switch fabric includes assigning a destination port of an output module to a data packet based on at least one field in a first header of the data packet. A module associated with a first stage of the switch fabric is selected based on at least one field in the first header. A second header is appended to the data packet. The second header includes an identifier associated with the destination port of the output module. The data packet is sent to the module associated with the first stage. The module associated with the first stage is configured to send the data packet to a module associated with a second stage of the switch fabric based on the second header.