Abstract: A method for communication includes configuring a router to forward data packets in a network in accordance with MPLS labels appended to the packets. A group of two or more of the interfaces is defined as a multi-path routing group in a forwarding table within the router. A plurality of records are stored in an ILM in the router, corresponding to different, respective label IDs, all pointing to the set of the entries in the forwarding table that belong to the multi-path routing group. Upon receiving in the router an incoming data packet having a label ID corresponding to any given record in the plurality, one of the interfaces in the group is selected, responsively to the given record and to the set of the entries in the forwarding table to which the given record points, for forwarding the incoming data packet without changing the label ID.

Abstract: Packet flows received in a data network are assigned to respective entries of a database. During an accumulation interval byte counts of the assigned packet flows are accumulated in the respective database entries. The packet flows are classified as elephant flows when differences between the byte counts and a reference byte count exceed a threshold and are reported after expiration of the accumulation interval.

Abstract: Packet flows received in a data network are assigned to respective entries of a database. During an accumulation interval byte counts of the assigned packet flows are accumulated in the respective database entries. The packet flows are classified as elephant flows when differences between the byte counts and a reference byte count exceed a threshold and are reported after expiration of the accumulation interval.

Abstract: A network switch includes circuitry, multiple ports and multiple hardware-implemented distinct-flow counters. The multiple ports are configured to receive packets from a communication network. Each of the multiple hardware-implemented distinct-flow counters is configured to receive (i) a respective count definition specifying one or more packet-header fields and (ii) a respective subset of the received packets, and to estimate a respective number of distinct flows that are present in the subset, by evaluating, over the packets in the subset, a number of distinct values in the packet-header fields belonging to the count definition. The circuitry is configured to provide each of the distinct-flow counters with the respective subset of the received packets, including providing a given packet to a plurality of the distinct-flow counters, and to identify an event-of-interest based on numbers of distinct flows estimated by the distinct-flow counters.

Abstract: A network switch includes circuitry, multiple ports and multiple hardware-implemented distinct-flow counters. The multiple ports are configured to receive packets from a communication network. Each of the multiple hardware-implemented distinct-flow counters is configured to receive (i) a respective count definition specifying one or more packet-header fields and (ii) a respective subset of the received packets, and to estimate a respective number of distinct flows that are present in the subset, by evaluating, over the packets in the subset, a number of distinct values in the packet-header fields belonging to the count definition. The circuitry is configured to provide each of the distinct-flow counters with the respective subset of the received packets, including providing a given packet to a plurality of the distinct-flow counters, and to identify an event-of-interest based on numbers of distinct flows estimated by the distinct-flow counters.

Abstract: A method for classification includes storing in a TCAM classification rules comprising respective tags, each including an update bit. Data items are classified by extracting a respective key from each data item, appending an update-select bit to construct an extended key, and matching the extended key to one of the tags in the TCAM. In response to an instruction to atomically replace a group of existing rules in the TCAM with new rules, the update bit is unmasked and set to the first bit value in the group of the existing rules. The new rules are stored in the TCAM, with their update bit set to a second bit value. After storing the new rules in the TCAM, the update-select bit in the extended key of the received data items is set to the second bit value.

Abstract: A method for classification includes storing in a TCAM classification rules comprising respective tags, each including an update bit. Data items are classified by extracting a respective key from each data item, appending an update-select bit to construct an extended key, and matching the extended key to one of the tags in the TCAM. In response to an instruction to atomically replace a group of existing rules in the TCAM with new rules, the update bit is unmasked and set to the first bit value in the group of the existing rules. The new rules are stored in the TCAM, with their update bit set to a second bit value. After storing the new rules in the TCAM, the update-select bit in the extended key of the received data items is set to the second bit value.

Abstract: A method for communication includes configuring a router to forward data packets in a network in accordance with MPLS labels appended to the packets. A group of two or more of the interfaces is defined as a multi-path routing group in a forwarding table within the router. A plurality of records are stored in an ILM in the router, corresponding to different, respective label IDs, all pointing to the set of the entries in the forwarding table that belong to the multi-path routing group. Upon receiving in the router an incoming data packet having a label ID corresponding to any given record in the plurality, one of the interfaces in the group is selected, responsively to the given record and to the set of the entries in the forwarding table to which the given record points, for forwarding the incoming data packet without changing the label ID.