Abstract: Protection switching between primary and secondary paths in a packet-based network involves table entries that are pre-programmed with a primary path, a secondary path, and a value that identifies the primary path, referred to as a primary path identifier (PPI). When table entries are accessed to make forwarding decisions, the PPI is compared to a field that identifies that a particular path is down, referred to as a down path identifier (DPI). If the two fields match, (i.e., PPI=DPI), then the secondary path is selected instead of the primary path as the path on which the traffic should be forwarded.

Abstract: Failure protection is provided between two routers that are actively implementing load sharing using network address translation. Failure protection is achieved by generating state information at the two routers and then exchanging the state information between the two routers so that each router has a combined set of state information that can be used in the event of a failure of the other router.

Abstract: Managing a position-dependent data set that is stored in a content addressable memory (CAM) array involves identifying an instance of a base position-dependent data set that exists in software, identifying an instance of an edited position-dependent data set that exists in software, determining differences between the instance of the base position-dependent data set that exists in software and the instance of the edited position-dependent data set that exists in software, and incorporating the differences between the instance of the base position-dependent data set that exists in software and the instance of the edited position-dependent data set that exists in software into an instance of said base position-dependent data set that exists in a CAM array.

Abstract: A technique for managing traffic in a multiport network node involves establishing customer-specific VLANs within the multiport network node that are identified by a combination of a VLAN ID and a customer ID. Traffic received at the multiport network node is mapped to a customer-specific VLAN and then broadcast to ports that are included in the customer-specific VLAN. Because customer-specific VLANs are identified by a combination of a VLAN ID and customer ID, a service provider can establish and maintain private broadcast domains on a per-customer ID basis. This enables the service provider to expand the number of unique VLAN IDs within the Service Provider Edge Device beyond the 4,096 limitation set by the IEEE 802.1Q standard while maintaining interoperability with the IEEE 802.1Q standard for incoming and outgoing traffic.

Abstract: An efficient mechanism for wire-tapping network traffic is disclosed. In one embodiment of the invention, a primary forwarding lookup process and a secondary forwarding lookup process are performed in parallel and independently of each other. The primary forwarding lookup process determines the output interface to which the packet is to be routed regardless of whether the packet is to be intercepted. The secondary forwarding lookup process determines whether the packet is to be intercepted and also determines the output interface to which a copy of the packet is to be routed. Because the lookup processes are performed independently and in parallel, normal packet forwarding can be performed at line rate or near line rate while the packets are intercepted.

Abstract: A technique for implementing VLANs across a service provider network involves establishing logical ports that have bindings to transport tunnels. The logical ports are then treated the same as physical ports in defining broadcast domains at particular service provider edge devices. Logical ports can be established for Layer 2 transport tunnels that use stacked VLAN tunneling and MPLS tunneling. Establishing a logical port that uses stacked VLAN tunneling involves binding a physical port and a stacked VLAN tunnel to the logical port. Establishing a logical port that uses MPLS tunneling involves binding an MPLS tunnel to a logical port. In one embodiment, the logical port is bound to a static MPLS tunnel and in another embodiment, the logical port is bound to a dynamic MPLS tunnel and the destination IP address of the destination service provider edge device.

Abstract: A method for filtering and selectively displaying log messages generated by a network node with a distributed architecture is disclosed. In one embodiment, log messages generated locally on the line cards are collected by Secondary Log Managers residing on the line cards. The Secondary Log Manager appends meta data to the collected messages and transfers at least part of them to a Primary Log Manager process residing at the control module. Using the meta data, the Primary Log Manager can selectively output the logging and tracing messages interested Command Line Interface (CLI) shells or output devices.

Abstract: Synchronizing multiple instances of an FIB in a network node that has a distributed processing architecture involves associating sequence numbers with all of the FIB entries that are stored with each instance of the FIB and using the sequence numbers that are associated with the FIB entries to determine the most current FIB entry. In one embodiment, the sequence numbers are used to determine the most current FIB entry among two matching FIB entries that have matching information (i.e., matching destination IP addresses and masks). In another embodiment, the sequence numbers are used to identify a line card with the most current FIB entry.

Abstract: Managing routes in a router involves the implementation of threshold-specific discard algorithms to discard redundant routes in an intelligent fashion based upon the volume of routes in the router. By employing threshold-specific discard algorithms to intelligently discard redundant routes within a router, the storage capacity of the router is utilized in a more efficient fashion because the routes are not dropped indiscriminately. A method and system comprise identifying a volume of routes in the router, determining whether the volume of routes has reached a threshold and applying a threshold-specific discard algorithm to routes in the router if the volume of routes has reached the threshold.

Abstract: Rate-limiting a traffic stream using a rate-limit hierarchy involves subjecting a packet to a first rate-limit check, said first rate-limit check corresponding to a first-level traffic classification, subjecting said packet to a second rate-limit check and an infinity rate-limit check, said second rate-limit check and said infinity rate-limit check corresponding to a second-level traffic classification, granting an automatic pass to said packet from said infinity rate-limit check regardless of whether or not said packet passes said second rate-limit check, and granting an overall pass of said rate-limit hierarchy if said packet passes said first rate-limit check. In an embodiment, the first-level traffic classification is a parent classification of said second-level traffic classification and said second-level traffic classification is a child classification of said first-level traffic classification.

Abstract: Performing cascading lookups at a network node involves using first header information from a packet to search a first set of search criteria for a match, identifying a tag associated with the match, and using second header information from the packet and the tag to search a second set of search criteria for another match.

Abstract: Protection switching between primary and secondary paths in a packet-based network involves table entries that are pre-programmed with a primary path, a secondary path, and a value that identifies the primary path, referred to as a primary path identifier (PPI). When table entries are accessed to make forwarding decisions, the PPI is compared to a field that identifies that a particular path is down, referred to as a down path identifier (DPI). If the two fields match, (i.e., PPI=DPI), then the secondary path is selected instead of the primary path as the path on which the traffic should be forwarded.

Abstract: A concept of “Interface Class” is introduced. All logical interfaces that belong to an Interface Class are indistinguishable in hardware. Each Interface Class is associated with one or more packet forwarding rules, such as Access Control Lists (ACLs), Policy Routes, and Quality of Service (QoS). Each Interface Class is also assigned with a Class ID, which is a user-defined integer. When defined in terms of a Class ID, a logical interface (e.g., an L3 Interface) will inherit all the packet forwarding rules associated with the Class ID. In one embodiment, Class IDs and Interface IDs can be stored in the same hardware lookup table in association with data representative of their respective packet forwarding rules.

Abstract: Distributing forwarding information in a router that has a distributed processing architecture involves distributing the forwarding information from one instance of an operating system to another instance of an operating system in parallel using two different communications channels where one of the communications channels is characteristically reliable yet relatively slow and where the other one of the communications channels is characteristically unreliable yet relatively fast. The forwarding information that is distributed via the relatively fast communications channel can be used to rapidly update forwarding tables such as hardware forwarding tables while the forwarding information that is distributed via the reliable communications channel can be used to resolve errors that may occur during distribution via the relatively fast communications channel.

Abstract: A method of operating a network node in PIM-SM (Protocol Independent Multicast-Sparse Mode) is disclosed. In one embodiment, a Rendezvous Point Tree (RPT) to Shortest Path Tree (SPT) switch over process is initiated after the packet flow rate of the RPT data stream is compared against a predetermined threshold using a reverse rate limiting technique. If the packet flow rate of the RPT data stream exceeds the threshold, further analysis can be performed to decide whether the RPT to SPT switch over process should be initiated. Otherwise, if the packet flow rate does not exceed a predetermined threshold, the network node continues to receive multicast packets via the RPT until the predetermined threshold is reached.

Abstract: An efficient Reverse Path Forwarding (RPF) check mechanism is disclosed. In one embodiment, when a network node receives a multicast packet on an incoming interface, the network node obtains an expected incoming interface identifier from either a unicast routing table or a multicast forwarding information table. A RPF Flag stored in association with multicast flow information determines from which table the interface identifier is obtained. If the expected incoming interface does not match the actual incoming interface, the multicast packet is discarded.

Abstract: Managing a position-dependent data set that is stored in a content addressable memory (CAM) array involves identifying an instance of a base position-dependent data set that exists in software, identifying an instance of an edited position-dependent data set that exists in software, determining differences between the instance of the base position-dependent data set that exists in software and the instance of the edited position-dependent data set that exists in software, and incorporating the differences between the instance of the base position-dependent data set that exists in software and the instance of the edited position-dependent data set that exists in software into an instance of said base position-dependent data set that exists in a CAM array.

Abstract: A method of completing a kernel work concurrently with non-kernel work in a computer device having a single-threaded kernel is disclosed. The computer device completes kernel work within the context of a pacer process, which is a user process. In particular, atomic portions of the kernel work are executed in the context of the pacer process at which point nothing else is allowed to run. When an atomic portion of the kernel work has been executed, the pacer process temporarily relinquishes the processor of the computer device, thus suspending the execution of the kernel work and allowing execution of non-kernel work. Interrupts are also handled when execution of the kernel work is suspended. Once the kernel work has been completed, the pacer process goes into a “sleep” mode to await the invocation of another kernel work.