Abstract: A distributed virtual appliance is disclosed, including: determining a classification type associated with the first flow; and determining an allocation of the first flow to the first data plane compute unit of the distributed virtual appliance based at least in part on the determined classification type and at least a subset of information of a first flow identifier, wherein the distributed virtual appliance includes a plurality of compute units, including the first data plane compute.

Abstract: Providing a shared interface among a plurality of compute units is disclosed. A plurality of compute units is determined and a shared interface for the plurality of compute units is provided, wherein incoming traffic is received by any of the plurality of compute units. Also, the packet is received at the shared interface for a plurality of compute units. The packet is encapsulated using a first header, wherein the first header specifies one of the plurality of compute units, and wherein the one of the plurality of compute units is selected independent of an interface address associated with the shared interface.

Abstract: A distributed virtual appliance is disclosed, including: allocating network traffic to a plurality of compute units implementing a network service associated with the distributed virtual appliance; and dynamically adding or removing one or more compute units implementing the network service without disruption to the network traffic.

Abstract: Methods and systems for assigning information indicative of a network characteristic to one of a plurality of data units traversing a path across a network, said data units having associated therewith values indicative of said network characteristic, said path having at least one portion passing through a lower-capability region and at least one portion passing through a higher-capability region, said lower-capability region being a region in which information indicative of said network characteristic may be represented by values having a first resolution, and said higher-capability region being a region in which information indicative of said network characteristic may be represented by values having a second resolution, said second resolution being greater than said first resolution, said one data unit being a data unit entering said higher-capability region.

Abstract: A distributed virtual appliance is disclosed, including: determining a classification type associated with the first flow; and determining an allocation of the first flow to the first data plane compute unit of the distributed virtual appliance based at least in part on the determined classification type and at least a subset of information of a first flow identifier, wherein the distributed virtual appliance includes a plurality of compute units, including the first data plane compute.

Abstract: Providing a shared interface among a plurality of compute units is disclosed. A plurality of compute units is determined and a shared interface for the plurality of compute units is provided, wherein incoming traffic is received by any of the plurality of compute units. Also, the packet is received at the shared interface for a plurality of compute units. The packet is encapsulated using a first header, wherein the first header specifies one of the plurality of compute units, and wherein the one of the plurality of compute units is selected independent of an interface address associated with the shared interface.

Abstract: A distributed virtual appliance is disclosed, including: allocating network traffic to a plurality of compute units implementing a network service associated with the distributed virtual appliance; and dynamically adding or removing one or more compute units implementing the network service without disruption to the network traffic.

Abstract: Flow in a data network is policed by determining a measure of greediness of a flow through a node, comparing the measure of greediness with a measure indicative of acceptable greediness dependent on the expected greediness of a compliant flow experiencing substantially similar path conditions, and designating the flow for possible sanction in the event that the greediness is not in accordance with the acceptable greediness. Such allows for the policing of a data network when one or more fields in a data packet that carry information relating to a characterization of an end-to-end path and/or a downstream path of the data packet are used in order to police the data network.

Abstract: Methods and systems for assigning information indicative of a network characteristic to one of a plurality of data units traversing a path across a network, said data units having associated therewith values indicative of said network characteristic, said path having at least one portion passing through a lower-capability region and at least one portion passing through a higher-capability region, said lower-capability region being a region in which information indicative of said network characteristic may be represented by values having a first resolution, and said higher-capability region being a region in which information indicative of said network characteristic may be represented by values having a second resolution, said second resolution being greater than said first resolution, said one data unit being a data unit entering said higher-capability region.

Abstract: Methods and apparatus for policing flow in a data network by determining a measure of greediness of a flow through a node, comparing said measure of greediness with a measure indicative of acceptable greediness dependent on the expected greediness of a compliant flow experiencing substantially similar path conditions, and designating the flow for possible sanction in the event that the greediness is not in accordance with said acceptable greediness. Such methods and apparatus allow for the policing of a data network wherein one or more fields in a data packet that carry information relating to a characterisation of an end-to-end path and/or a downstream path of said data packet are used in order to police said data network.