Abstract: Systems and methods are described that provide for distributively storing and accessing data across multiple hash tables, such that utilization of the hash tables is optimized. In particular, a key associated with a value is split into two or more sub-keys and the sub-keys are inserted into respective hash tables with associated values. For each sub-key except the final sub-key derived from a particular key, the value paired with the sub-key is an identifier that points to the location of the next sub-key and its associated value, which may be stored in the other hash tables. The final sub-key derived from the original key is paired with the value associated with the key, such as an action to be performed. Thus, rather than using a single key (which may be very large) to access or store a particular value, multiple (smaller) sub-keys are used to ultimately access the same value via multiple, smaller hash tables.

Abstract: A method in a network element that includes multiple interfaces for connecting to a communication network includes receiving via an ingress interface packets that are not allowed to undergo re-routing and that are addressed to a destination via a first egress interface. The packets are forwarded via the first egress interface when there is a valid path from the first egress interface to the destination. When there is no valid path from the first egress interface to the destination, a second egress interface is selected from a group of multiple egress interfaces that have respective paths to the destination and are assigned to packets for which re-routing is allowed, and the packets are forwarded via the second egress interface until recovering a path to the destination.

Abstract: A method for classification includes storing in a TCAM classification rules comprising respective tags, each including an update bit. Data items are classified by extracting a respective key from each data item, appending an update-select bit to construct an extended key, and matching the extended key to one of the tags in the TCAM. In response to an instruction to atomically replace a group of existing rules in the TCAM with new rules, the update bit is unmasked and set to the first bit value in the group of the existing rules. The new rules are stored in the TCAM, with their update bit set to a second bit value. After storing the new rules in the TCAM, the update-select bit in the extended key of the received data items is set to the second bit value.

Abstract: A method for classification includes storing in a TCAM classification rules comprising respective tags, each including an update bit. Data items are classified by extracting a respective key from each data item, appending an update-select bit to construct an extended key, and matching the extended key to one of the tags in the TCAM. In response to an instruction to atomically replace a group of existing rules in the TCAM with new rules, the update bit is unmasked and set to the first bit value in the group of the existing rules. The new rules are stored in the TCAM, with their update bit set to a second bit value. After storing the new rules in the TCAM, the update-select bit in the extended key of the received data items is set to the second bit value.

Abstract: A method for communication includes configuring a router to forward data packets over a network in accordance with Multiprotocol Label Switching (MPLS) labels appended to the data packets. At least first and second entries, corresponding to respective first and second labels, are stored in a Next Hop Label Forwarding Entry (NHLFE) table in the router, such that each of the first entries contains a respective pointer to at least one of the second entries. Upon receiving in the router a data packet from the network, a first entry is selected from among the first entries in the NHLFE table and, responsively to the pointer in the first entry, a second entry is selected. The respective first and second labels from the selected first and second entries are pushed onto an MPLS label stack of the data packet.

Abstract: A deep packet inspection method and device, and a coprocessor. The deep packet inspection method includes receiving, by a transceiver module of the coprocessor, an original data packet sent by a general processor, and sending the original data packet to a processor core of the coprocessor; invoking, by the processor core, a sub-coprocessor of the coprocessor to perform application layer parsing on the original data packet so as to obtain an application layer parsing result; and sending, by the processor core, the parsing result to the general processor so that the general processor processes the original data packet according to the parsing result. The deep packet inspection method and device provided by the embodiments of the present disclosure reduce resource occupation of a general processor and increase a running speed.

Abstract: A network element includes circuitry and one or more interfaces. The interfaces are configured to connect to a communication network. The circuitry is configured to assign multiple egress interfaces corresponding to respective different paths via the communication network for routing packets to a given destination-address group, to hold, for the given destination-address group, respective state information for each of multiple sets of hash results, to receive via an ingress interface a packet destined to the given destination-address group, to calculate a given hash result for the packet and identify a given set of hash results in which the given hash result falls, and to forward the packet via one of the multiple egress interfaces in accordance with the state information corresponding to the given destination-address group and the given set of hash results.

Abstract: A method in a network element that includes multiple interfaces for connecting to a communication network includes receiving via an ingress interface packets that are not allowed to undergo re-routing and that are addressed to a destination via a first egress interface. The packets are forwarded via the first egress interface when there is a valid path from the first egress interface to the destination. When there is no valid path from the first egress interface to the destination, a second egress interface is selected from a group of multiple egress interfaces that have respective paths to the destination and are assigned to packets for which re-routing is allowed, and the packets are forwarded via the second egress interface until recovering a path to the destination.