Abstract: A method is implemented by a node of a network domain having a plurality of nodes, where the node functions as an ingress node of the network domain for a data flow. The method enables data flow analysis across the network domain. The method includes receiving a data packet belonging to a data flow at an ingress node of the network domain, determining whether the data packet is to be marked for the data flow analysis, determining whether an egress node of the network domain for the data flow supports data packet marking, marking the data packet with a marking label indicating to supporting nodes in the network domain that the data packet is to be processed for data flow analysis, and forwarding the data packet toward the egress node of the network domain.

Abstract: A method is implemented by a node for enabling shortest path bridging in a network that is scalable to support sixteen million virtual local area network (VLAN) identifiers using multiprotocol label switching (MPLS) encapsulation. The method comprises allocating a tunnel label using a distributed tunnel label allocation algorithm, allocating a source label using a distributed source label allocation algorithm, assigning a bridge instance a service label, and distributing the tunnel label, source label and service label to other nodes in the MPLS network.

Abstract: Exemplary methods for performing service chaining include generating a plurality of service chaining (SC) next hops (NHs) by, for each SC NH hop, generating a plurality of SC maps, each SC map identifying a chain of one or more service modules, wherein each service module is to apply a corresponding service on a packet. The methods further include generating a plurality of hosted NHs, each hosted NH including forwarding information that causes the packet to be forwarded to a corresponding service module. The methods further include in response to receiving a first packet, identifying a SC NH of the plurality of SC NHs based on an Internet Protocol (IP) address of the first packet, and forwarding the first packet to a service module based on the identified SC NH.

Abstract: A network device executes a method to forward a packet that is encoded using an explicit list encoding of sparse multicast group membership information with Bit Index Explicit Replication. The method includes receiving a packet that includes a bitstring having a list of Bit Forwarding Router IDs (BFR-ids). The method further includes selecting a BFR-id identifying a destination Bit Forwarding Router (BFR) from the list for processing, looking up a forwarding bitmask for the destination BFR and a next-hop to reach the destination BFR in a bit index forwarding table, creating a copy of the packet, clearing the selected BFR-id from the packet, clearing BFR-ids from the packet and the copy of the packet based on the forwarding bitmask, and forwarding the copy of the packet to the next-hop neighbor.

Abstract: A method in a router for initiating fast flooding based fast convergence to recover from a network failure is disclosed. The method also starts with detecting a network failure. Responsive to the detected network failure, the router floods a layer 2 fast failure notification message out a set of one or more interfaces of the router. The fast failure notification message includes information that identifies the network failure and indicates to a router that receives the fast failure notification message to flood the fast failure notification message out its interfaces that are not blocked by a spanning tree protocol (STP) independently of updating its routing table to reflect the network failure. The method continues with the router updating a routing table to reflect the network failure.

Abstract: A method is implemented by a node of a network domain having a plurality of nodes, where the node functions as an ingress node of the network domain for a data flow. The method enables data flow analysis across the network domain. The method includes receiving a data packet belonging to a data flow at an ingress node of the network domain, determining whether the data packet is to be marked for the data flow analysis, determining whether an egress node of the network domain for the data flow supports data packet marking, marking the data packet with a marking label indicating to supporting nodes in the network domain that the data packet is to be processed for data flow analysis, and forwarding the data packet toward the egress node of the network domain.

Abstract: A method is implemented by a node for enabling shortest path bridging in a network that is scalable to support sixteen million virtual local area network (VLAN) identifiers using multiprotocol label switching (MPLS) encapsulation. The method comprises allocating a tunnel label using a distributed tunnel label allocation algorithm, allocating a source label using a distributed source label allocation algorithm, assigning a bridge instance a service label, and distributing the tunnel label, source label and service label to other nodes in the MPLS network.

Abstract: Exemplary methods for performing service chaining include generating a plurality of service chaining (SC) next hops (NHs) by, for each SC NH hop, generating a plurality of SC maps, each SC map identifying a chain of one or more service modules, wherein each service module is to apply a corresponding service on a packet. The methods further include generating a plurality of hosted NHs, each hosted NH including forwarding information that causes the packet to be forwarded to a corresponding service module. The methods further include in response to receiving a first packet, identifying a SC NH of the plurality of SC NHs based on an Internet Protocol (IP) address of the first packet, and forwarding the first packet to a service module based on the identified SC NH.

Abstract: A network device executes a method to forward a packet that is encoded using an explicit block encoding of multicast group membership information with Bit Index Explicit Replication. The method includes receiving a packet, where the packet includes a bitstring having a set of blocks, each block including a set identifier field and a SubBitString field. The method further includes selecting a block for processing, finding a first bit position of a SubBitString identifying a destination bit-forwarding router (BFR), looking up a forwarding bitmask for the destination BFR and a next-hop to reach the destination BFR in a bit index forwarding table, creating a copy of the packet, applying a bit-wise AND operation on the copy of the packet with the forwarding bitmask, forwarding the copy of the packet to the next-hop, and applying a bit-wise AND operation on the packet with an inverse of the forwarding bitmask.

Abstract: A network device executes a method to forward a packet that is encoded using an explicit block encoding of multicast group membership information with Bit Index Explicit Replication. The method includes receiving a packet, where the packet includes a bitstring having a set of blocks, each block including a set identifier field and a SubBitString field. The method further includes selecting a block for processing, finding a first bit position of a SubBitString identifying a destination bit-forwarding router (BFR), looking up a forwarding bitmask for the destination BFR and a next-hop to reach the destination BFR in a bit index forwarding table, creating a copy of the packet, applying a bit-wise AND operation on the copy of the packet with the forwarding bitmask, forwarding the copy of the packet to the next-hop, and applying a bit-wise AND operation on the packet with an inverse of the forwarding bitmask.

Abstract: A network device executes a method to forward a packet that is encoded using an explicit list encoding of sparse multicast group membership information with Bit Index Explicit Replication. The method includes receiving a packet that includes a bitstring having a list of Bit Forwarding Router IDs (BFR-ids). The method further includes selecting a BFR-id identifying a destination Bit Forwarding Router (BFR) from the list for processing, looking up a forwarding bitmask for the destination BFR and a next-hop to reach the destination BFR in a bit index forwarding table, creating a copy of the packet, clearing the selected BFR-id from the packet, clearing BFR-ids from the packet and the copy of the packet based on the forwarding bitmask, and forwarding the copy of the packet to the next-hop neighbor.

Abstract: A method in a router for initiating fast flooding based fast convergence to recover from a network failure is disclosed. The method also starts with detecting a network failure. Responsive to the detected network failure, the router floods a layer 2 fast failure notification message out a set of one or more interfaces of the router. The fast failure notification message includes information that identifies the network failure and indicates to a router that receives the fast failure notification message to flood the fast failure notification message out its interfaces that are not blocked by a spanning tree protocol (STP) independently of updating its routing table to reflect the network failure. The method continues with the router updating a routing table to reflect the network failure.

Abstract: A network element supports Transmission Control Protocol Authentication Option (TCP-AO) with a Key Management Protocol (KMP) to authenticate TCP segments over a TCP session. The network element negotiates multiple traffic keys to authenticate TCP segments over a TCP session with a peer network element, and protects the TCP session with the negotiated traffic keys.

Abstract: A router detects a network failure and responsive to that failure, floods a fast failure notification message out a set of interfaces of the router. The fast failure notification message includes information that identifies the network failure and includes as its source MAC (Media Access Control) address a MAC address that is assigned to an interface that is coupled with the detected network failure and is not part of the set of interfaces of the router. The router updates a routing table to reflect the network failure. The flooding of the fast failure notification message is performed prior to completion of the routing table update to reflect the network failure.

Abstract: Fast flooding based fast convergence to recover from a network failure. A router detects a network failure, and responsive to that failure, transmits a fast failure notification message to a set of one or more routers. The fast failure notification message includes information that identifies the network failure and also indicates that the fast failure notification message is to be flooded by the set of routers independently of convergence. The router updates a routing table to reflect the network failure. The transmission of the fast failure notification message is performed prior to completion of the routing table update to reflect the network failure.

Abstract: A network element supports Transmission Control Protocol Authentication Option (TCP-AO) with a Key Management Protocol (KMP) to authenticate TCP segments over a TCP session. The network element negotiates multiple traffic keys to authenticate TCP segments over a TCP session with a peer network element, and protects the TCP session with the negotiated traffic keys.

Abstract: Fast flooding based fast convergence to recover from a network failure. A router detects a network failure, and responsive to that failure, transmits a fast failure notification message to a set of one or more routers. The fast failure notification message includes information that identifies the network failure and also indicates that the fast failure notification message is to be flooded by the set of routers independently of convergence. The router updates a routing table to reflect the network failure. The transmission of the fast failure notification message is performed prior to completion of the routing table update to reflect the network failure.

Abstract: A router detects a network failure and responsive to that failure, floods a fast failure notification message out a set of interfaces of the router. The fast failure notification message includes information that identifies the network failure and includes as its source MAC (Media Access Control) address a MAC address that is assigned to an interface that is coupled with the detected network failure and is not part of the set of interfaces of the router. The router updates a routing table to reflect the network failure. The flooding of the fast failure notification message is performed prior to completion of the routing table update to reflect the network failure.

Abstract: Scalable data forwarding techniques in a switched network are described herein. In one embodiment, an example of a process for forwarding data includes, in response to a first packet received from a first local node over a local area network (LAN) and destined to a first remote node over a provider network, a provider edge (PE) device of the provider network substituting a source MAC (media access control) address of the first packet with a virtual MAC address associated with the PE device, and the PE device transmitting the first packet having the virtual MAC address as the source MAC address to the first remote node over the provider network. Other methods and apparatuses are also described.

Abstract: Source routed multicast LSP is described herein. In one embodiment, when a first node receives a first packet having a label stack including a plurality of labels compatible with MPLS (multi-protocol label switching), in response to a first label on a top of the label stack, the first packet is duplicated into a second packet. In addition, at least two labels are popped from the top of the label stack of the second packet forming a third packet. Thereafter, the first and third packets are processed based on a label on the top of the label stack of the first and third packets respectively. Other methods and apparatuses are also described.