Abstract: The throughput of a network appliance can be increased by a circuit that produces an encrypted block and a digest value while requiring only a single read of a data block. Data blocks, including a first data block, are stored in a memory that can be accessed by an ASIC that includes an encryption offload circuit. The ASIC can read the first data block from the memory and the encryption offload circuit can produce a first encrypted block and a first digest value from the first data block. The ASIC can produce a network packet that includes the first encrypted block and a data digest value. The first digest value is used to produce the data digest value, and a single read of the first data block from the memory is performed for producing the first encrypted block and also for calculating the first digest value.

Abstract: Upgrading a network appliance to a second firmware is dynamically specified and implemented to minimize network disruption. The installed firmware runs in a first execution domain and the second firmware runs in safe mode in a second execution domain. Upgrade planning data is produced by monitoring service executables in the second execution domain for stage failures at various execution states. The upgrade planning data is used to produce an upgrade specification for upgrading from the installed firmware to the second firmware. The upgrade planning data can indicate that there are execution state dependencies between the service executables. The upgrade specification can be adapted for the execution state dependencies and used by a finite state machine to implement the upgrade.

Abstract: A system includes a hardware entity that can perform tasks in a secure mode or in an insecure mode. The system's secure resources include a secure memory and a secure logical interface (LIF). The system's insecure resources include an insecure memory and a first insecure LIF. A security mode circuit in the hardware entity can set the hardware entity to secure mode or to insecure mode. Tasks submitted via the secure LIF are performed in secure mode. Tasks submitted via the insecure LIF are performed in insecure mode. The tasks are associated with security mode status indicators that are written to the hardware entities security mode indicator to thereby set the hardware entity into secure mode or insecure mode. The hardware entity cannot access secure resources while in insecure mode.

Abstract: Interval binary tree definitions and binary tree definitions can be stored in the memory of a networking device. The interval binary trees can map IP address ranges and port ranges to class identifiers. A networking device receives an IP packet that has a layer 3 header that includes an IP address and a port number. The networking device can use the IP address, the port number, and the interval binary trees to determine a first class identifier and a second class identifier. The first class identifier can indicate a binary tree definition that is searched for the second class identifier. The search identifies yet another class identifier that the networking device uses to determine a networking rule to apply to the IP packet. This technique uses far less memory than the RFC algorithm commonly used to determine a networking rule to apply to the IP packet.

Abstract: A networking device in a high availability (HA) configuration processes network flows for a virtual network interface card (VNIC). Network configurations include networking policies governing network packet processing by the networking device. Global epoch values are associated with each network configuration version. The networking device has a control plane, a data plane, and a flow table. The control plane uses the most recent network configuration to produce flow table entries for storage in the flow table. The data plane uses the flow table entries to process network packets. Flow table entries include flow epoch values matching the global epoch value associated with the network configurations used to create the flow entries. Datapath epoch values, VNIC peer epoch values, and VNIC local epoch values are associated with the VNICs and used to ensure consistent flow table entries among the peers in the HA configuration.

Abstract: Methods and systems for active-standby switchover are disclosed. Embodiments of the present technology may include a method for operating a network with active and standby host nodes that involves transmitting a Border Gateway Protocol (BGP) route advertisement message from the standby host node, the BGP route advertisement message including route information and a community tag that is indicative of a graceful attract community, receiving the BGP route advertisement message at leaf nodes and spine nodes of the network, wherein the leaf nodes and the spine nodes assign higher BGP preference to the route information in the BGP route advertisement message in response to identifying the community tag in the BGP route advertisement message as being indicative of a graceful attract community, and transmitting a BGP route withdraw message from the active host node after the BGP route advertisement message is transmitted from the standby host node.

Abstract: A networking device can use sync request packets to synchronize connection objects with a peer. Real or virtual flow misses occurring in the data plane while processing a network packet indicate that synchronization is needed. A virtual flow miss occurs when a data plane connection object is obsolete. A sync request packet containing connection metadata and the network packets is sent to the peer. The peer uses the connection metadata to create or update its version of the connection object then returns a sync ack packet that contains the network packet. Receiving a sync ack packet can indicate that the locally stored version of the connection object and the peer's version of the connection object are consistent. The network packet may be processed normally when the locally stored version of the connection object and the peer's version of the connection object are consistent.

Abstract: An orchestrator can send trace directives to network appliances that indicate a network flow to trace. The network appliances can include packet processing pipelines that each include numerous processing stages. The network appliances implement network rules for processing network flows by configuring the pipeline's processing stages to execute specific policies for specific network packets in accordance with the network rules. The processing stages can also be configured to produce metadata indicating the policies implemented at each stage to process certain network packets in network flows indicated by trace directives. The metadata can be used to produce a trace report that indicates a network packet of the network flow, a first network rule that was applied to the network packet by a one of the first appliance processing stages, and the one of the first appliance processing stages that applied the first network rule to the network packet.

Abstract: The rate limiter circuits in the packet processing chip of a NIC are a limited hardware resource that may limit the number of workloads that can be run on a server. Some such chips include an egress packet processing pipeline circuit and a second packet processing pipeline circuit that prepares work for the egress pipeline circuit. Some of the stages of the second pipeline circuit can be configured as a first limiter and a second limiter that implement aspects of different rate limiters such as IOPS limiters, bandwidth limiters, etc. Another pipeline stage can use the outputs of the different rate limiters to make a limiting decision that is written into one of the rate limiter circuits. The second pipeline circuit is thereby implementing virtualized rate limiters where one of the rate limiter circuits performs the rate limiting for the virtualized rate limiters.

Abstract: SR-IOV (single root IO virtualization) capable PCIe devices can implement virtual functions (VFs) that are assigned to VMs running on a host machine, thereby speeding IO operation by writing directly to the VMs' memory while bypassing the hypervisor managing the VMs. As such, VFs thwart the dirty page tracking that hypervisors use to minimize VM downtime when the VM is migrated between hosts. The SR-IOV PCIe devices can help resolve this problem by maintaining dirty page tracking data for VMs running on the host machine. The SR-IOV PCIe devices bypassing the hypervisor while writing into a memory page of the VM can set the dirty page tracking data to indicate the memory pages that are dirty (i.e., written to by the VF), and can provide access to the dirty page tracking data. The hypervisor can thereby obtain and use the dirty page tracking data.

Abstract: A networking device can include a packet processing pipeline circuit and a processor. The packet processing pipeline circuit can be configured to implement a data plane and the processor can be configured to implement a control plane. The packet processing pipeline circuit and the processor can also be configured to send a plurality of heartbeat packets on multiple paths to a second networking device. The data plane can produce and send the heartbeat packets to the second networking device within a heartbeat period. The data plane may send a second plurality of heartbeat packets on multiple paths to the second networking device with a second heartbeat period. The heartbeat packets can have unique packet five tuples that include an IP address of the second networking device.

Abstract: Tenants in data centers may want access to high precision clocks without having to run their own PTP stacks or reference clocks. Furthermore, different tenants may want their workloads synchronized to their own secured clock domain. PTP, the currently dominant synchronization protocol, allows for only 256 clock domains (CDs). Virtual CDs (vCDs) virtualize the concept of clock domains by maintaining a hardware clock within a host computer, receiving a network clock domain packet that includes a clock domain identifier and an origin timestamp produced by a reference clock, using the network clock domain packet to synchronize the hardware clock to the reference clock, and using the hardware clock to provide a hardware timestamp value to a virtual machine (VM) running on the host computer or to a process running on the host computer, wherein the hardware clock is secured from manipulation by the VM or by the process.

Abstract: Described are input output (IO) device configured to perform operations for performing a table lookup with a single wide key larger than a width of a system bus. These operations comprise: receiving the lookup key; performing a plurality of extraction cycles to determine a plurality of key fragments; calculating a final hash value for the lookup key by sequentially calculating, via a hash chain, an interim hash value for each of the key fragments; determine a read access address for a table entry of a logic table based on the final hash value for the lookup key; determine a plurality of read requests based on the read access address; determine a hit on the table entry with the lookup key by issuing each of the read requests to the memory subsystem; and provide the hit on the table entry to the requesting entity or a next processing entity.

Abstract: Network appliances can record log entries in log objects. An object store can receive the log objects and can use the log objects to create index objects and flow log objects. Each flow log object and index object can be associated with a time period wherein the flow log object includes flow log entries received during that time period. The index object includes shard tables that can be stored in different nonvolatile memories and can thereby be concurrently searched. Shard entries in the shard tables indicate flow entry indicators. The flow entry indicators indicate log entries in the flow log object. An internally indexed searchable object can include the flow log object and the index object. Numerous indexed fields in the flow log entries and can be indexed with each indexed field searchable via the shard entries.

Abstract: Methods and systems for autonomous rule-based task coordination amongst edge devices are disclosed. Embodiments of the present technology may include a method for processing packet traffic at an edge device, the method including determining a side of a communication that corresponds to an edge device with regard to packet traffic. Embodiments may also include applying a task distribution rule to the packet traffic using the determined side of the communication that corresponds to the edge device to determine if a particular task related to the packet traffic should be executed at the edge device. In some embodiments, the task distribution rule is configured to ensure that the particular task is executed at only one side of the communication.

Abstract: A network appliance or smart switch can include service devices as well as a switching device such as those used in high-speed switches having limited processing ability and are stateless with respect to sessions. Service devices can provide stateful and complex processing. A first exposed port of a switching device can receive network packets and can determine which network packets the service devices are to process to produce processed network packets. A network packet can be sent to a service device in a redirected packet. A processed network packet can be received from a service device in a reinjected packet that is used to recover a port identifier of the first exposed port. The port identifier can be used to determine a network destination of the processed network packet. The processed network packet can be sent from a second exposed port of the switching device toward the network destination.

Abstract: A network appliance can continue operation at a degraded level during an upgrade that requires less free pipeline memory than other upgrade techniques. The network appliance has a control plane and has a data plane with a packet processing pipeline circuit. Before the upgrade, the control plane has configured the packet processing pipeline circuit to process a network flow. The packet processing pipeline may be halted in order to perform a pipeline upgrade during which the packet processing pipeline circuit's pipeline memory is cleared. The packet processing pipeline circuit is restarted after the pipeline upgrade after which the control plane can reconfigure the packet processing pipeline circuit to process the network flow. The packet processing pipeline circuit can therefore process the network flow after the pipeline upgrade.

Abstract: HA peers can include networking devices that have data planes and control planes that configure the data plane to use status data in a memory for processing network packets of network flows. The HA peers synchronize the status data such that one peer can take over when another fails. When a HA peer is brought up, data plane syncing synchronizes data for new network flows but not existing network flows. A first bulk sync operation synchronizes data for existing flows but not for new flows. A second bulk sync operation can synchronize the data for flows that changed state during the first bulk sync operation. Data plane syncing can sync data for all flows after the first bulk sync operation.

Abstract: Synchronizing the databases maintained by network appliances can support high availability or high throughput topologies, but also consumes the devices' processing resources. To address that resource consumption, the network appliance's packet processing pipeline circuits can process synchronization packets to thereby synchronize the databases. A local data structure can be in a first local state. Processing a network packet can result in changing the local data structure to a second local state. A state sync packet can include state transition data that indicates a state difference between the first local state and the second local state. The state sync packet can be sent to a peer device that is configured to process the state transition data using the peer device's packet processing pipeline circuit. The peer device's packet processing pipeline can use the state transition data to update a peer device data structure that is in the peer device.

Abstract: Data centers often run long lived services such as web servers that are intended to run for hours, days, or even longer before being torn down and replaced with another instance of the long-lived service. Currently, many applications are being implemented with microservice architectures that run short lived services that start up, implement an operation, and are then torn down. An aspect of starting up a service is creating administrative data structures such as InfiniBand queue pairs. A packet processing pipeline having a DMA output stage can be configured to create the administrative data structures, thereby increasing the rate at which the administrative data structures are created. As a result, services running in data centers can be started up more rapidly and efficiently.