Abstract: An example of a computing system is described herein. The computing system includes a plurality of network security devices. The computing system also includes a network switch configured to direct network traffic. The computing system further includes a controller coupled to the network switch. The controller is to instruct the network switch in directing network traffic to the plurality of network security devices.

Abstract: In some examples, a system populates a distribution data structure useable by a switch in distributing communications of data packets across a plurality of network paths for the switch. In response to an addition of a new network path or a removal of an existing network path for the switch, the system updates entries of the distribution data structure using a process that identifies selected entries of the distribution data structure to skip as part of updating the distribution data structure.

Abstract: Example implementations relate to load balancing network traffic flows in a network switching device. According to an example, in a network switching device, a method to load balance network traffic flows across links of the device includes identifying a flow of the network traffic flows as an elephant flow. In response to identifying the flow as an elephant flow, the method collects remote utilization information for the flow. The method recomputes a path for the flow based on local utilization information and the collected remote utilization information and sends the flow along the recomputed path.

Abstract: Example embodiments disclosed herein relate to implementing pre-filter rules at a network infrastructure device. In one example, the network infrastructure device receives a packet flow including a first pre-filter tag including information from implementation of a first subset of a set of pre-filter rules. In the example, the network infrastructure device includes logic to implement a second subset of the pre-filter rules. The second subset of pre-filter rules are different from the first subset of pre-filter rules. The second subset of pre-filter rules are implemented on the packet flow to yield a pre-filter result.

Abstract: In some examples, a system populates a distribution data structure useable by a switch in distributing communications of data packets across a plurality of network paths for the switch. In response to an addition of a new network path or a removal of an existing network path for the switch, the system updates entries of the distribution data structure using a process that identifies selected entries of the distribution data structure to skip as part of updating the distribution data structure.

Abstract: Systems and methods associated with service insertion forwarding are disclosed. One example method includes building a service insertion address table. The service insertion address table may associate service insertion tunnels with device addresses based on payload source addresses retrieved from packets received via the service insertion tunnels. The method also includes forwarding a packet received from a source device to a destination device. The packet may be received from the source device via a source service insertion tunnel. The packet may be forwarded to the destination device via a destination service insertion tunnel. The destination service insertion tunnel may be associated with the destination device in the service insertion address table.

Abstract: Example implementations relate to load balancing network traffic flows in a network switching device. According to an example, in a network switching device, a method to load balance network traffic flows across links of the device includes identifying a flow of the network traffic flows as an elephant flow. In response to identifying the flow as an elephant flow, the method collects remote utilization information for the flow. The method recomputes a path for the flow based on local utilization information and the collected remote utilization information and sends the flow along the recomputed path.

Abstract: Example implementations relate to load balancing network traffic flows in a network switching device. According to an example, a network switching device may include a port to receive a packet in a network flow, a bin mapper module to map the packet to a bin of a plurality of bins, and a path determination module to determine available paths from the network switching device to a destination device for the packet. The device can also include a profile score module to determine a profile score for each candidate link implicated by the determined available paths, the profile score being based on a proportion of the available paths that use the candidate link. The device can also include a link-usage-by-destination score module to determine, for each candidate link, a link-usage-by-destination score that represents an amount of traffic that has been sent on each candidate link to the destination relative to all candidate links.

Abstract: Example embodiments disclosed herein relate to implementing pre-filter rules at a network infrastructure device. In one example, the network infrastructure device receives a packet flow including a first pre-filter tag including information from implementation of a first subset of a set of pre-filter rules. In the example, the network infrastructure device includes logic to implement a second subset of the pre-filter rules. The second subset of pre-filter rules are different from the first subset of pre-filter rules. The second subset of pre-filter rules are implemented on the packet flow to yield a pre-filter result.

Abstract: Examples include a network device to filter a packet for a packet type. The network device includes a filter to receive the packet and to determine whether the packet is a defined packet type. The network device also includes a Bloom filter to receive the packet from the filter based on the determination that the packet is a defined packet type and to determine whether the packet is a matched packet or an unmatched packet. A processing resource of the network device may receive the packet from the Bloom filter based on the determination that the packet is a matched packet and to determine whether the packet is an exact match.

Abstract: Example implementations relate to load balancing network traffic flows in a network switching device. According to an example, a network switching device may include a port to receive a packet in a network flow, a bin mapper module to map the packet to a bin of a plurality of bins, and a path determination module to determine available paths from the network switching device to a destination device for the packet. The device can also include a profile score module to determine a profile score for each candidate link implicated by the determined available paths, the profile score being based on a proportion of the available paths that use the candidate link. The device can also include a link-usage-by-destination score module to determine, for each candidate link, a link-usage-by-destination score that represents an amount of traffic that has been sent on each candidate link to the destination relative to all candidate links.

Abstract: Systems and methods associated with service insertion forwarding are disclosed. One example method includes building a service insertion address table. The service insertion address table may associate service insertion tunnels with device addresses based on payload source addresses retrieved from packets received via the service insertion tunnels. The method also includes forwarding a packet received from a source device to a destination device. The packet may be received from the source device via a source service insertion tunnel. The packet may be forwarded to the destination device via a destination service insertion tunnel. The destination service insertion tunnel may be associated with the destination device in the service insertion address table.

Abstract: An example of a computing system is described herein. The computing system includes a network switch configured to direct network traffic. The computing system also includes a network device to receive the network traffic. The computing system further includes a controller coupled to the network switch. The controller is to monitor network traffic in the network switch and generate a policy to instruct the network switch in selecting a portion of the network traffic to direct to the network device.

Abstract: An example of a computing system is described herein. The computing system includes a plurality of network security devices. The computing system also includes a network switch configured to direct network traffic. The computing system further includes a controller coupled to the network switch. The controller is to instruct the network switch in directing network traffic to the plurality of network security devices.

Abstract: A network device having a plurality of packet forwarding elements, each including a hardware component for receiving and forwarding data packets from and to other network devices via a plurality of input ports connected to a network. Each hardware component is configured to determine whether a received data packet is one of a predetermined class of data packets based on data in the received data packet and, if so, generate expedited processing instructions corresponding to the received data packet based on data in the received data packet. The hardware component forwards the received data packet, together with the corresponding expedited processing instructions, directly to the hardware component of all packet forwarding elements of the plurality of packet forwarding elements for processing based on the expedited processing instructions.

Abstract: Data is moved through a pipeline as processing of the data unrelated to detection of pattern is performed. The detector detects the pattern within the data at a predetermined location or based on a predetermined reference as the data is moved through the pipeline, in parallel with the processing of the data as the data is moved through the pipeline. The detector detects the pattern within the data as the data is moved through the pipeline without delaying movement of the data into, through, and out of the pipeline.

Abstract: System and methods for metering output packet traffic at network devices. Ingress packet lookups are employed in combination with egress packet meters, which can be arranged in parallel fashion, and used to meter traffic across multiple blades of a switch chassis. Also, egress packet traffic metering is accomplished while matching complex ingress rules without additional egress packet processing. The system has a first node for creating requests that contain a number of filter indicies for specifying packet forwarding criteria. The first node also specifies values for the filter and meter indicies based on a packet to be forwarded. The system also has a second node coupled to the first node and to a number of ports. The second node has at least one table for specifying which of the ports are to receive the packet based on the filter values, and at least one table for accounting for egress traffic bandwidth.

Abstract: A method of transmitting an upstream communication packet from a distributed trunk (DT) switch is described. The method comprises receiving a packet from a device connected to a DT port of the DT switch; and transmitting the received packet via a non-DT port of the DT switch if the DT switch is the owner of the device and transmitting the received packet via a DT interconnect (DTI) port of the DT switch if the DT switch is not the owner of the device.

Abstract: A method of transmitting an upstream communication packet from a distributed trunk (DT) switch is described. The method comprises receiving a packet from a device connected to a DT port of the DT switch; and transmitting the received packet via a non-DT port of the DT switch if the DT switch is the owner of the device and transmitting the received packet via a DT interconnect (DTI) port of the DT switch if the DT switch is not the owner of the device.

Abstract: A network, network devices, and methods are described for packet processing indication. A method includes tunneling a packet from a first network device to a second network device associated with a first checking functionality. The second network device has an address different than an original destination address of the packet. The method also includes return-tunneling the packet from the second network device to the first network device with an indication of whether the packet was processed by the first checking functionality. The method includes tunneling the packet from the first network device to a third network device associated with a second checking functionality in response to the indication being that the packet was not processed by the first checking functionality. The third network device has an address different from the original destination address of the packet.