Abstract: In general, techniques are described for efficiently and transparently partitioning a physical address space of a DRAM part lacking dedicated error protection circuitry to supply addressable error protection bytes for use in detecting and/or correcting bit errors elsewhere present in the physical address space. In one example, a network device includes a DRAM and a memory controller that receives a write command to write data to the DRAM. An address translation module of the memory controller logically partitions the DRAM to define a plurality of physically addressable sections that includes an error protection section for storing error protection bits and one or more data storage sections. The memory controller defines a contiguous logical address space representing the data storage sections. A DRAM controller of the network device communicates with the DRAM to store the data to one of the data storage sections in accordance with the contiguous logical address space.

Abstract: Multicast traffic received by a subnet that uses IGMP/PIM snooping may be efficiently processed so that only required multicast router interfaces are used. A router may, for example, receive a source-specific PIM join/prune message indicating that a multicast receiver of the multicast traffic is to join/leave a multicast group to receive/stop traffic from a multicast source; determine whether the router is a first hop router relative to a subnet of the multicast source; and forward, when the router is a first hop router relative to the subnet of the multicast source and is a non-designated router, the source-specific PIM join/prune message towards the subnet.

Abstract: A security device may be interconnected, via multiple links, between multiple network devices in a network. The firewall device may include multiple input interfaces that receive data units from a first network device destined for a second network device of the multiple network devices, identify a session associated with each of the data units, and process the data units in accordance with the identified sessions and a security policy.

Abstract: A packet-forwarding integrated circuit includes a control logic module and a selector block configured to produce a value indicating an incoming interface associated with a multicast data stream that meets stream health requirements, wherein the multicast data stream is one of a plurality of redundant multicast data streams each received on different incoming interfaces, wherein based on the value produced by the selector block the control logic module outputs data packets of the multicast data stream that meets stream health requirements received on the incoming interface, and discards data packets of other multicast data streams received on other incoming interfaces not indicated by the selector block. In response to detecting that a quality of one of the redundant multicast data streams has fallen below a configured threshold, the control logic automatically rewrites the selector block to forward a different one of the redundant multicast data streams.

Abstract: A system is configured to receive traffic being transported via a network; obtain, as a result of receiving the traffic, content from one or more packets associated with the traffic; analyze the content to identify one or more attributes associated with the content, where the one or more attributes correspond to at least one of: a network address, information associated with an application with which the traffic is associated, information associated with message content, or information associated with software content; determining that at least one attribute, of the one or more attributes, matches an attribute, of a set of attributes that are stored within a memory, where the set of attributes corresponds to a set of categories of traffic; identify a category, of the set of categories, that corresponds to the attribute; associate the category and the traffic; and process the traffic based on the associated category.

Abstract: A rack system may include a first plurality of line cards, where a particular one of the first plurality of line cards receives or sends packets via ports; a plurality of fabric cards, where a particular one of the plurality of fabric cards includes a switching fabric; a second plurality of line cards, where a particular one of the second plurality of line cards receives or sends packets via ports; a first backplane that connects the first plurality of line cards to the plurality of fabric cards; and a second backplane that connects the second plurality of line cards to the plurality of fabric cards.

Abstract: Methods, computer program products and apparatus for processing data packets are described. Methods include receiving the data packet, examining the data packet, determining a single flow record associated with the packet and extracting flow instructions for two or more devices from the single flow record.

Abstract: In general, techniques are described for dynamically scheduling and establishing paths in a multi-layer, multi-topology network to provide dynamic network resource allocation and support packet flow steering along paths prescribed at any layer or combination of layers of the network. In one example, a multi-topology path computation element (PCE) accepts requests from client applications for dedicated paths. The PCE receives topology information from network devices and attempts to identify paths through a layer or combination of layers of the network that can be established at the requested time in view of the specifications requested for the dedicated paths and the anticipated bandwidth/capacity available in the network. The PCE schedules the identified paths through the one or more layers of the network to carry traffic for the requested paths. At the scheduled times, the PCE programs path forwarding information into network nodes to establish the scheduled paths.

Abstract: A system may include a power module that includes a group of power supplies, particular ones of the group of power supplies being operable at a group of voltages ranging from a first voltage to a second voltage. The system may further include a controller coupled to the particular ones of the group of power supplies, the controller being to ramp up an output voltage, associated with the group of power supplies, from the first voltage to the second voltage in a group of discrete steps; where ramping up the output voltage by a particular one of the group of discrete steps is performed while a load is receiving power from the group of power supplies; and where ramping up the output voltage by a particular one of the group of discrete steps prevents over-current protection on the group of power supplies from being activated.

Abstract: A multicast-capable firewall allows firewall security policies to be applied to multicast traffic. The multicast-capable firewall may be integrated within a routing device, thus allowing a single device to provide both routing functionality, including multicast support, as well as firewall services. The routing device provides a user interface by which a user specifies one or more zones to be recognized by the integrated firewall when applying stateful firewall services to multicast packets. The user interface supports a syntax that allows the user to define subsets of the plurality of interfaces associated with the zones, and define a single multicast policy to be applied to multicast sessions associated with a multicast group. The multicast policy identifies common services to be applied pre-replication, and exceptions specifying additional services to be applied post-replication to copies of the multicast packets for the one or more zones.

Abstract: Managing TCP anycast requests at content delivery network nodes is disclosed. In some embodiments, serving a request includes receiving a request at a node of a plurality of nodes comprising a content delivery network, wherein each of the plurality of nodes share a same anycast IP address to which the request is directed and servicing the request at the node.

Abstract: A system includes a memory and a controller. The controller may include a group of pads and an allocation register. The controller is configured to receive input signals corresponding to the group and allocate each one of the pads to output one of the input signals based on a configuration of pins of the memory. The controller is also configured to redirect the input signals, within the controller, based on the allocation of the pads and output the input signals from the controller into the pads.

Abstract: In one embodiment, a method, comprising receiving at a receive side of a physical link a request to suspend transmission of data from a queue within a transmit side of a first stage of queues and to suspend transmission via a path including the physical link, a portion of the first stage of queues, and a portion of a second stage of queues. The method includes sending, in response to the request, a flow control signal to a flow control module configured to schedule transmission of the data from the queue within the transmit side of the first stage of queues. The flow control signal is associated with a first control loop including the path and differing from a second control loop that excludes the first stage of queues.

Abstract: In some embodiments, an apparatus comprises a switch from a set of switches associated with a stage of a multi-stage switch fabric. The switch is configured to receive a data packet having a destination address of a destination device from a source device, and then store the data packet in a queue of the switch. The switch is configured to define a message based on the queue having an available capacity less than a threshold, and include a congestion root indicator in the message if the switch is a congestion root. The switch is then configured to send the message to the source device such that the source device sends another data packet having the destination address of the destination device to another switch from the set of switches and not to the previous switch if the message includes the congestion root indicator.

Abstract: A switching device includes multiple interfaces and a switch fabric. The switch fabric includes switch integrated circuits arranged in a number of stages. Multiple virtual switch planes may be implemented in the switch fabric. Data traffic received at the interfaces is selectively assigned to different ones of the virtual switch planes.

Abstract: An access server generates a handshake with storage servers resulting in more rapid access to the stored data, for example, video data, by a user. The handshake also results in load balancing effects.

Abstract: A system and method may assist in securing data for transmission to a receiving entity. Received data may include metadata associated therewith. The data may be encrypted using an encryption key encoded within selected portions of the metadata, where the selection of the selected portions is based on a scheme shared with the receiving entity. The encrypted data including the metadata may be transferred to the receiving entity. The receiving entity may decrypt the encrypted data using the selected portions of the metadata.

Abstract: In one example, a method includes identifying a plurality of common direct routes to computing devices that are associated with a common indirect route to the computing devices. The method also includes generating a direct route structure that is associated with an entry of a forwarding structure using a next hop list, wherein the next hop list comprises: (1) a reference that identifies the direct route structure, the direct route structure comprising a plurality of direct next hops associated with the common direct routes to computing devices, (2) and an indirect next hop associated with an indirect next hop to the computing devices. The method also includes configuring the next hop list to use the direct route structure to route network data. The method also includes forwarding, by the computing device, network data according to the forwarding structure and the direct route structure.

Abstract: In general, techniques are described for using routing information obtained by operation of network routing protocols to dynamically generate network and cost maps for an application-layer traffic optimization (ALTO) service. For example, an ALTO server of an autonomous system (AS) receives routing information from routers of the AS by listening for routing protocol updates outputted by the routers and uses the received topology information to dynamically generate a network map of PIDs that reflects a current topology of the AS and/or of the broader network that includes the AS. Additionally, the ALTO server dynamically calculates inter-PID costs using received routing information that reflects current link metrics. The ALTO server then assembles the inter-PID costs into a cost map that the ALTO server may provide, along with the network map, to clients of the ALTO service.

Abstract: In general, techniques are described for simplifying admission control signaling between subscriber devices, access nodes, and service edge routers to facilitate subscriber-specific admission control for multicast streams. In one example, a service edge router receives a service request and accesses a subscriber profile to determine whether the requesting subscriber is authorized to receive the service. Upon authorization, the service edge router returns the service request to the access node in a substantially similar form in which the service request was received. The access node receives the service request on a service edge router-facing interface, indicating the service edge router has granted authorization for the subscriber device to receive multicast traffic associated with the multicast group identified within the service request.