Abstract: In general, techniques are described for supporting interchassis redundancy (ICR) by a plurality of network access servers (NASes) that are members of an ICR. For example, techniques may be used to associate, within a RADIUS server, multiple NAS identifiers for the NASes with a single NAS identifier alias. The RADIUS server is configured to handle RADIUS protocol messages from any member of the ICR cluster as though the RADIUS protocol messages issued from a single NAS having the NAS identifier alias.

Abstract: Techniques are described for providing high availability for a network device, e.g., a router, using full memory replication between a primary virtual machine (VM) and a standby VM running on the network device. In one example, the techniques provide hot-standby high availability for a router by initializing a primary VM and a standby VM on the router at the same time. In another example, the techniques provide high availability for the router by initializing a standby VM on the router upon detecting a failure of the primary VM. In both examples, the primary VM controls the routing functionality and periodically stores a full memory state. Upon a failure of the primary VM, a hypervisor may perform a full memory replication between the primary VM and the standby VM. The standby VM may then take control of the routing functionality at the last stored state of the memory.

Abstract: A network device may receive a request from a local device to establish a connection with a another device. The request may include an internal network identifier of the local device. The network device may evaluate a plurality of external network identifiers, associated with the network device based on selected criteria. The network device may also, or alternatively, evaluate the external network identifiers by identifying an external network identifier that is already mapped to, or paired with, the internal network identifier. The network device may select an external network identifier, of the plurality of external network identifiers, based on the evaluation and establish the connection requested by the local device using the internal network identifier and the external network identifier.

Abstract: In some embodiments, an apparatus includes a first network control entity configured to be implemented at a first edge device. The first network control entity is configured to receive a control packet from a peripheral processing device via a tunnel that is between the peripheral processing device and the first network control entity and that includes at least a portion within a second edge device. The first network control entity is configured to determine routing information associated with the peripheral processing device based on the control packet. The first network control entity is configured to send the routing information to a second network control entity such that the second network control entity routes a data unit addressed to the peripheral processing device to the second edge device without sending the data unit to the first edge device.

Abstract: A device provides an ager ring that ages entries associated with managed resource of a device, and determines whether a particular entry associated with a particular managed resource of the device is to be updated. The device also updates, when the particular entry is to be aged out in a particular time frame, the particular entry in the ager ring based on a bucket offset and a current time bucket associated with the particular entry and based on a current time, a refresh timeout, and a maximum timeout associated with the ager ring. The device further updates, when the particular entry is being aged during processing, the particular entry in the ager ring based on a new bucket, the current time bucket, and the bucket offset associated with the particular entry and based on the maximum timeout associated with the ager ring.

Abstract: A wireless access point may include a processor to communicate with a management device over a network; a wired Ethernet interface to the network; and a wireless interface to connect, using a local wireless protocol, to one or more client computing devices, where the wireless access point provides an access point for the one or more client computing devices to connect to the network. The wireless access point may further include an interface to provide a local connection to a modular device, where the processor is to transmit, over the network, data received from the modular device to the management device or data received from the management device to the modular device; and a housing to contain the processor, the wired Ethernet interface, the wireless interface, and the interface to provide the local connection.

Abstract: Static analysis of software code may be performed in a selective regression testing framework. The static impact analysis, when carried out in a comprehensive and efficient way, can help make the test selection safer and more complete. One method for performing static analysis in selective regression testing of a software project includes, for example, storing changes to source code that defines functions and global data elements of the software project; performing a static analysis of the source code to determine which global data elements in the source code correspond to changed functions in the source code and executing a regression test of the software project using a set of test units determined based, at least in part, on the static analysis.

Abstract: A network device that rewrites web content may include logic to support the operation of rewriter filters that augment the network device's built-in rewriter. The rewriter filters may be used to correct deficiencies in the built-in rewriter without requiring a new built-in rewriter to be installed.

Abstract: A method may include determining one or more rules and communicating the one or more rules to a firewall, where the firewall receives a data unit and determines, based on the one or more rules, whether to forward the data unit to a destination address; receiving a redirection of a device from the firewall when the firewall determines not to forward the data unit to the destination address; receiving an indication that the firewall did not forward the data unit to the destination address; and determining a new rule to allow the firewall to forward the data unit to the destination address and communicating the new rule to the firewall; and redirecting the device to the destination address.

Abstract: A network device may include a timing module and at least one interface. The timing module determines a local time of the network device indicating when the network device sends a synchronization start message. The at least one interface sends the synchronization start message to a time client device to set the current time of day on the time client device, receives a synchronization response message from the time client device indicating that the current time of day of the time client device was set, and sends a synchronization success message to the time client device indicating that the time client device has correctly set its current time of day.

Abstract: A user device receives a captured image of an encoded identifier, analyzes the encoded identifier via the captured image, and extracts, based on the analysis, network access configuration data from the encoded identifier. The user device provides the network access configuration data to a network access control (NAC) device, and receives, based on the network access configuration data, access to the NAC device. The user device permits the NAC device to inspect the user device via the access to the NAC device, and receives, based on the inspection of the user device, access to a network.

Abstract: In general, this disclosure describes a high-level forwarding path description language (FPDL) for describing internal forwarding paths within a network device. The FPDL enables developers to create a template that describes a section of an internal forwarding path within the forwarding plane of a network device. The FPDL provides syntactical elements for specifying the allocation of forwarding path structures as well as enabling the run-time construction of internal forwarding paths to interconnect the forwarding path structures in a manner specific to packet, packet flow, and/or interface properties, for example. In conjunction with late binding techniques, whereby the control plane of the network device provides arguments to template parameters that drive allocation by the packet forwarding engines of forwarding path structures specified by the FPDL, the techniques provide control plane processes a unified interface with which to manage the operation of the packet forwarding engines.

Abstract: A method and apparatus for performing a lookup in a switching device of a packet switched network where the lookup includes a plurality of distinct operations each of which returns a result that includes a pointer to a next operation in a sequence of operations for the lookup. The method includes determining a first lookup operation to be executed, executing the first lookup operation including returning a result and determining if the result includes a pointer to another lookup operation in the sequence of operations. If the result includes a pointer to another lookup operation, the lookup operation indicated by the result is executed. Else, the lookup is terminated.

Abstract: A method may include receiving a packet; determining a set of characteristics of the packet; searching a first tree structure for a rule matching the set of characteristics, where the first tree structure stores a first group of rules, and where each of the first group of rules has a first number and a first type of criteria; searching a second tree structure for the rule matching the set of characteristics, where the second tree structure stores a second group of rules, and where each of the second group of rules has a second number and a second type of criteria, where the number and type of criteria of the second group of rules are different at least in part than the number and type of criteria of the first tree structure; and performing an action if the rule matching the set of characteristics is found.

Abstract: A node is configured to receive a packet from a host device, where the packet includes a source address associated with the host device; determine that the source address is not stored by the node; generate one or more logical distances, associated with one or more nodes, based on the source address and a respective address associated with each of the nodes; determine that another node is associated with a shortest logical distance, of the one or more logical distances; and transmit the source address to the other node based on the determination that the other node is associated with the shortest logical distance, where transmitting the source address allows the other node to store the source address or enables further nodes to obtain the source address from the other node.

Abstract: A switching device in a network system for transferring data includes one or more source line cards, one or more destination line cards and a switching fabric coupled to the source line cards and the destination line cards to enable data communication between any source line card and destination line card. Each source line card includes a request generator to generate a request signal to be transmitted in order to obtain an authorization to transmit data. Each destination line card includes a grant generator to generate and send back a grant signal to the source line card in response to the request signal received at the destination line card to authorize the source line card to transmit a data cell to the destination line card.

Abstract: A system and method for the automated configuration of network resources is described. In one embodiment, a network management device can manage virtual network entities, such as virtual network switch fabrics, by provisioning physical network resources for and deallocating physical network resources from virtual network entities. The network management device can determine available physical network resources by broadcasting request signals to physical network resources and listening for advertisement response signals from available physical network resources.

Abstract: In some embodiments, an apparatus includes a first housing, a second housing and at least one cable. The first housing includes a first interface card of a switch fabric. The second housing includes a second interface card of the switch fabric and a third interface card of the switch fabric. The second interface card of the switch fabric is operatively and physically coupled to the third interface card of the switch fabric via a midplane. The second interface card defines a plane that is nonparallel to the a plane defined by the third interface card and a plane defined by the midplane. The plane defined by the third interface card is nonparallel to the plane defined by the second interface card and the plane defined by the midplane. The cable is configured to operatively couple the first interface card to the second interface card.

Abstract: A first provider edge (PE) device is configured to: receive a Label Distribution Protocol (LDP) MAC Flush message from a PE device via an input port; flush a routing table in response to the LDP MAC Flush message; determine whether the LDP MAC Flush message comprises a PE identifier corresponding to the PE device; generate a Topology Change Notification (TCN) message based on the LDP MAC Flush message when the LDP MAC Flush message comprises the PE identifier corresponding to the PE device; and output the TCN message.

Abstract: A switch device is configured to receive a data unit from a virtual port from a first set of virtual ports. The switch device is configured to associate an identifier of each virtual port from the first set of virtual ports with an identifier of a first access group that is associated with an access set. The switch device is configured to prohibit the data unit from being sent to a remaining virtual port from the first set of virtual ports if the data unit is addressed to that virtual port. The switch device is configured to otherwise allow the data unit to be sent to a virtual port from a second set of virtual ports associated with a second access group when the second access group is associated with the access set. The second set of virtual ports is mutually exclusive from the first set of virtual ports.