Abstract: Methods and apparatuses for inspecting packets are provided. A primary security system may be configured for processing packets. The primary security system may be operable to maintain flow information for a group of devices to facilitate processing of the packets. A secondary security system may be designated for processing packets upon a failover event. Flow records may be shared from the primary security system with the secondary security system.

Abstract: A cross-bar switch includes a set of input ports for receiving data packets and a set of sink ports for transmitting the received packets to identified targets. A set of data rings couples the input ports to the sink ports. Each sink port utilizes the set of data rings to simultaneously accept multiple data packets targeted to the same destination—creating a non-blocking cross-bar switch. Sink ports are also each capable of supporting multiple targets—providing the cross-bar switch with implicit multicast capability.

Abstract: To satisfy a quality required for each traffic and perform switching for a packet segmented into cells without packet reassembly, there is provided a node apparatus including a header processing section (2) for determining an output destination of an incoming packet and a quality class from the header information of the packet, a route table (3), and a quality description table (4), and storing the packet in an output queue (6) determined by the determined output destination and quality class, an output control section (7) for reading out a packet from the output queue in accordance with the quality set for each output queue (6) and sending out the read packet through a VC determined by the determined output destination and quality class, and a quality description table (4) which has at least a virtual dedicated network number field, a destination address/mask length field, a source address/mask length field, a fourth-layer protocol/destination port number field, and a destination port number field and in whi

Abstract: A method may include counting the number of times each of a plurality of entries in a content addressable memory (CAM) matches one or more searches; grouping entries in the CAM into a first subset and a second subset based on the number of times each of the plurality of entries in the CAM matches one or more searches; and searching the first subset for a matching entry and, if no matching entry is found, searching the second subset for the matching entry.

Abstract: A cable modem termination system (CMTS) provides for ordered switchover of the cable modems it serves when a primary module of the CMTS fails. When the primary module in the CMTS fails, a backup module takes over service of the cable modems. The backup module restores the service flows of the cable modems based on a restoration order determined by session recovery priorities that are related to quality of service levels required by the service flows. In particular, service flows that are engaged in VoIP “911” calls are restored first. Service flows engaged in other VoIP calls are next restored. Lastly, service flows engaged in regular data sessions are restored.

Abstract: A system processes packet data received in a number of incoming streams of variable speeds. The system includes an input interface, input logic, and one or more packet processors. The input interface receives the packet data and outputs the data using a first arbitration element. The input logic includes flow control logic, a memory, and a dispatch unit. The flow control logic initiates flow control on the data output by the input interface. The memory stores the data from the input interface. The dispatch unit reads the data from the memory using a second arbitration element. The packet processor(s) process the data from the dispatch unit.

Abstract: The invention provides an ATM switch which realizes hierarchical shaping for each virtual channel and each virtual path with a simple configuration. Cells are sent from cell buffers of an ATM core switch by FIFO operation to output side connection information application sections of output side circuit interfaces. In each of the output side circuit interfaces, the output side connection information application section acquires connection information such as a service class based on an intra-switch connection identification number applied to each cell and applies the connection information to the cell. An output cell buffer queues cells for each virtual channel. A VC cell rate control section reads out cells from the output cell buffer in accordance with the connection information and performs traffic priority control and rate control of the cells to be outputted.

Abstract: Reversible airflow in cooling systems of electronic devices is described. For example, an electronic device may include a reversible fan tray. The fan tray may include symmetric mounting features that allow the fan tray to be mounted in the electronic device in more than one orientation at the same location within the electronic device such that one or more fans in the fan tray either direct air into the electronic device or to pull air from electronic device. The fan tray may further include a symmetric arrangement of connectors that coincide with the symmetric arrangement of mounting features to allow the fan tray to be connected to a power source of the electronic device any of the more than one orientations. An arrangement of electronic devices including reversible fan trays may be configured so that inlet and outlet airflows are separated to increase cooling efficiency of the electronic devices.

Abstract: A device associated with the authentication of a user on a network, i.e., an “authentication device,” initiates lawful interception of network traffic associated with the user. The authentication device communicates with a network service device, such as an edge router, providing network access or other services to the user to enable and disable monitoring of the network user. The authentication device may issue intercept requests to the network service device upon authenticating the network user during login or at any time while the network user's session is in progress. Upon receiving an intercept request from the authentication device, the network service device mirrors data packets flowing to and from the network user for which interception has been designated. The mirrored packets are sent to an analyzer, which analyzes the packets and provides packet analysis information to a law enforcement agency.

Abstract: A method of scheduling upstream bandwidth. This method comprises: 1) anticipating the need for the upstream bandwidth in advance of any specific request for said upstream bandwidth; and 2) scheduling the upstream bandwidth in accordance with such need.

Abstract: A system determines when to send out a partial data unit or when to complete a data unit before sending it. The system may identify a data unit, determine whether the data unit is a partial data unit, increase a partial count when the data unit is the partial data unit, determine whether the partial count is greater than a threshold, and fill a subsequent data unit with data to form a complete data unit when the partial count is greater than the threshold. The system may, alternatively or additionally, determine a schedule of flush events for a queue, identify whether the queue includes information associated with a partial data unit, identify whether the queue should be flushed based on the schedule of flush events and whether the queue includes information associated with the partial data unit, wait for additional data when the queue should not be flushed, and send out the partial data unit when the queue should be flushed.

Abstract: Methods, computer program products and apparatus for processing data packets are described. Methods include receiving the data packet, examining the data packet, determining a single flow record associated with the packet and extracting flow instructions for two or more devices from the single flow record.

Abstract: A method may include counting the number of times each of a plurality of entries in a content addressable memory (CAM) matches one or more searches; grouping entries in the CAM into a first subset and a second subset based on the number of times each of the plurality of entries in the CAM matches one or more searches; and searching the first subset for a matching entry and, if no matching entry is found, searching the second subset for the matching entry.

Abstract: A fabric request controller implements flow control for data cells to a network or switch fabric. The fabric request controller issues request messages to the fabric switch and receives back corresponding grant messages. The fabric request controller includes a credit counter for metering the number of allowable outstanding requests. A fake request vector component periodically issues fake requests to compensate for information loss on the switch fabric.

Abstract: A network device includes a memory and a packet forwarding engine. The memory stores a multicast list table, tag descriptor data and layer 2 (L2) encapsulation data. The packet forwarding engine receives a first pointer to an entry in the multicast list table, the entry including a second pointer to the tag descriptor data. The packet forwarding engine utilizes the second pointer to retrieve the tag descriptor data, the tag descriptor data including a third pointer to the encapsulation data. The packet forwarding engine constructs a packet header utilizing the retrieved encapsulation data and appends the packet header to a packet payload for forwarding out of the packet forwarding engine.

Abstract: Systems, apparatus, methods, and computer program products for multicast access control are provided to analyze incoming data based on a source zone and a destination zone of the incoming data. Appropriate access control rules are applied to incoming data based on the results of the analysis. Additional implementations of a multicast access control include using a proxy rendezvous point operable to function as a rendezvous point in place of a physical rendezvous point.

Abstract: A network device includes a group of high speed redundant transmission lines and a switch. The switch is configured to select one of the high speed redundant transmission lines. The switch causes reflections and frequency dependent dispersions in the selected high speed redundant transmission line. The network device further includes a transmitting device that is configured to adjust signals transmitted over the selected high speed redundant transmission line so as to reduce the reflections and frequency dependent dispersions.

Abstract: An ATM (asynchronous transfer mode) cell transfer apparatus includes an input interface, a switch block, and an OAM cell processing hardware block having a memory unit. The input interface receives an SDH/SONET signal on each of a plurality of first transfer paths to output an input OAM cell corresponding to the SDH/SONET signal to one of a plurality of input ports of the switch block corresponding to the first transfer path for the SDH/SONET signal to be transferred. The switch block receives the input OAM (operation and maintenance) cell from the corresponding input port as an OAM input port to output to the OAM cell processing hardware block together with a port number of the OAM input port, and receives at least one output OAM cell from the OAM cell processing hardware block to output to at least one of the plurality of output ports based on the received output OAM cell.

Abstract: In general, techniques are described for summarizing label mappings and thereby enabling longest-prefix match within Multi-Protocol Label Switching (MPLS) networks. More specifically, a first router included within a first area of a network comprises a control unit that maintains a label space defining labels available for mapping to a plurality of addresses assigned to network devices within the network. The control unit reserves a contiguous set of the labels of the label space and maps the contiguous set of labels to first area addresses. The first area addresses include those addresses of the plurality of addresses available for assignment to network devices within the first area. The first router also includes an interface card that transmits, to a second router of a second area of the network, an advertisement that advertises a summarized version of the mapping between the contiguous set of labels and the first area addresses.

Abstract: A method may include receiving a packet associated with a flow of packets, the packet including a destination address; selecting one of a plurality of memory banks, the selected memory bank being associated with the flow of packets, wherein each of the plurality of memory banks stores the same next-hop information for forwarding the packet to the destination address; accessing, in the selected memory bank, the next-hop information for forwarding the packet to the destination address; and forwarding the packet to the destination address based on the next-hop information.