Abstract: The Switch includes a port configured to receive a command frame when installed in a switching Fabric. The frame identifies a source device and a destination device in the Switching Fabric, a command, and a read/write flag which indicates if the identified source intends to exercise read-only or write access to the destination device. The Switch also includes a processor coupled to the port. The processor is configured to trap the frame and prevent it from reaching the defined destination device in the switching Fabric if both the source and destination devices are in a read-only zone and the flag indicates that the source intends to write to the destination device. In this manner, read-only zones can be implemented in the Switching Fabric.

Abstract: Methods and apparatus are provided for label switched routing in fibre channel networks. Techniques are provided for implementing label switching based on particular characteristics of fibre channel networks. By using label switching, mechanisms such as traffic engineering, security, and tunneling through networks that do not support fibre channel frames can be implemented.

Abstract: In one embodiment, a MUD logger receives a notification from another MUD logger maintaining another MUD log for a volume, the notification indicating one or more modifications to be made to a MUD log maintained by the MUD logger receiving the notification, wherein the MUD log includes information for one or more epochs, wherein the information for each of the epochs indicates a set of one or more regions of the volume that have been modified during the corresponding epoch. The MUD logger updates the MUD log associated with the volume, wherein updating the MUD log is performed in response to the notification.

Abstract: Methods and apparatus are provided for label switched routing in fibre channel networks. Techniques are provided for implementing label switching based on particular characteristics of fibre channel networks. By using label switching, mechanisms such as traffic engineering, security, and tunneling through networks that do not support fibre channel frames can be implemented.

Abstract: A system and method maps Virtual Local Area Network (VLAN) designations to Internet Protocol version 6 (IPv6) site identifiers (IDs), and embeds site IDs into scoped internet addresses in such a way as to facilitate processing by primarily hardware-oriented forwarding tables. A router has a plurality of interfaces for receiving and forwarding packets, and a route processor for making forwarding decisions for received packets. The route processor includes a routing engine, a routing table, a forwarding information base (FIB), a VLAN store and a site ID store. At least some of the router's interfaces are associated with corresponding VLAN IDs, and the site ID store is preconfigured with a mapping of VLAN IDs to site IDs.

Abstract: Methods and apparatus for performing MUD logging for a volume in a system implementing network-based virtualization are disclosed. This is accomplished by enabling two or more MUD loggers to separately maintain a MUD log for the volume. Through enabling the MUD loggers to communicate, the MUD loggers may update their respective MUD logs. Each MUD log includes information for one or more epochs, where the information for each of the epochs indicates a set of one or more regions that have been modified during the corresponding epoch.

Abstract: Embodiments of the invention improve the detection of malicious software applications, such as a rootkit, on hosts configured to access storage volumes over a storage area network (SAN). A rootkit detection program running on a switch may be configured to detect rootkits present on the storage volumes of the SAN. Because the switch may mount and access storage volumes independently from the (possibly comprised) hosts, the rootkit is not able to conceal itself from the rootkit detection program running on the switch.

Abstract: A way to assign flexible prefixes to Switches in Fibre Channel Fabrics while using the currently defined FC_ID address space. This allows end devices in different Fibre Channel Fabrics to communicate with one another, without requiring modifications to existing end devices, nor to perform Network Address Translation between Fabrics. The existing address space for each Switch includes a dynamically configurable number of host bits sufficient to address all the end devices coupled to the Switch and the Switch itself. The remaining bits, called the Switch prefix, are used to identify the Switch in the switching Fabric. In an alternative embodiment, the Switch prefix bits may be further configured into a first sub-set of bits used to identify a specific Fabric (Fabric prefix) and a second sub-set of bits used to identify the Switch in the Fabric (Switch_ID).

Abstract: A Fibre Channel Switch which enables end devices in different Fabrics to communicate with one another while retaining their unique Fibre Channel Domain_IDs. The Switch is coupled to a first fabric having a first set of end devices and a second fabric having a second set of end devices. The Switch is configured to enable communication by the first set of end devices associated with the first fabric with the second set of end devices associated with the second set of end devices using the unique Domain_IDs of each of the first set and the second set of end devices. In one embodiment of the invention, the first and second fabrics are first and second Virtual Storage Array Networks (VSANs) respectively. In an alternative embodiment, the first fabric and the second fabric are separate physical fabrics.

Abstract: A way to assign flexible prefixes to Switches in Fiber Channel Fabrics while using the currently defined FC_ID address space. This allows end devices in different Fiber Channel Fabrics to communicate with one another, without requiring modifications to existing end devices, nor to perform Network Address Translation between Fabrics. The existing address space for each Switch includes a dynamically configurable number of host bits sufficient to address all the end devices coupled to the Switch and the Switch itself. The remaining bits, called the Switch prefix, are used to identify the Switch in the switching Fabric. In an alternative embodiment, the Switch prefix bits may be further configured into a first sub-set of bits used to identify a specific Fabric (Fabric prefix) and a second sub-set of bits used to identify the Switch in the Fabric (Switch_ID).

Abstract: Disclosed is apparatus and methods for enabling an appliance to receive data being sent between any host of a host cluster to a specified storage device's logical unit (LUN) in a single stream or session. In one embodiment, a data virtual target is initially set up for a specified storage device LUN so that data written from a host to the specified storage device LUN is received by the DVT. An appliance then sends a session request to mirror data that is sent to the DVT (and specified storage device LUN) to a specified LUN of the appliance. The session request is not host specific. That is, data that is sent by any host to the DVT is mirrored to the same appliance LUN.

Abstract: An Fibre Channel Switch which enables end devices in different Fabrics to communicate with one another while retaining their unique Fibre Channel Domain_IDs. The Switch is coupled to a first fabric having a first set of end devices and a second fabric having a second set of end devices. The Switch is configured to enable communication by the first set of end devices associated with the first fabric with the second set of end devices associated with the second set of end devices using the unique Domain_IDs of each of the first set and the second set of end devices. In one embodiment of the invention, the first and second fabrics are first and second Virtual Storage Array Networks (VSANs) respectively. In an alternative embodiment, the first fabric and the second fabric are separate physical fabrics.

Abstract: In one embodiment, a network device receives a port login directed to a target from a first host. The network device determines whether at least one other host is currently logged in to the target. The network device may then send a port login to the target corresponding to whether at least one other host is currently logged in to the target.

Abstract: A scalable NAS file system and protocols for implementing CIFS thereon are disclosed. In certain embodiments, the protocols implement the CIFS protocol on a scalable file server architecture having one or more protocol termination nodes, one or more file server nodes, and one or more disk controller nodes. Among the features that may be specifically implemented are tree access, file access, user authentication, locking, state maintenance, and failover of protocol termination nodes and file server nodes.

Abstract: Disclosed are methods and apparatus for data tapping within a storage area network (SAN) and providing tapped data to a third party device, such as an appliance. In general, mechanisms are provided in a SAN to allow a data tap of data flowing between an initiator and a target. In one implementation, a data virtual target (DVT) in created in a network device to intercept data sent by a specific initiator to a specific logical unit of a specific target. The data or a copy of the data is sent to both the specific logical unit of the specific target and to an appliance. The data routing may be accomplished by use of a virtual initiator (VI), which is configured to send the data (or a copy of the data) to the specific target and the appliance. In a transparent mode of operations, the DVT has a same PWWN (port world wide name) and FCID (fibre channel identifier) as the specific target. In a first proxy mode of operation, the DVT has a different PWWN and FCID than the specific target.

Abstract: Methods and apparatus for processing a reserve request requesting a reservation of at least a portion of a volume in a system implementing network-based virtualization of storage are disclosed. More particularly, multiple ports and/or network devices together implement the virtualization of storage. When a network device or port receives a reserve request from a host requesting that at least a portion of a volume be reserved, a notification is sent indicating the at least a portion of the volume being reserved. The notification may be sent to one or more network devices or ports. A lock corresponding to the reserve request may then be obtained such that a lock of the at least a portion of the volume is acquired. When another network device or port receives a reserve intention notification, the network device or port stores information indicating that a lock of the at least a portion of the volume has been obtained.

Abstract: Methods and apparatus for performing MUD logging for a volume in a system implementing network-based virtualization are disclosed. This is accomplished by enabling two or more MUD loggers to separately maintain a MUD log for the volume. Through enabling the MUD loggers to communicate, the MUD loggers may update their respective MUD logs. Each MUD log includes information for one or more epochs, where the information for each of the epochs indicates a set of one or more regions that have been modified during the corresponding epoch.

Abstract: The Switch includes a port configured to receive a command frame when installed in a switching Fabric. The frame identifies a source device and a destination device in the Switching Fabric, a command, and a read/write flag which indicates if the identified source intends to exercise read-only or write access to the destination device. The Switch also includes a processor coupled to the port. The processor is configured to trap the frame and prevent it from reaching the defined destination device in the switching Fabric if both the source and destination devices are in a read-only zone and the flag indicates that the source intends to write to the destination device. In this manner, read-only zones can be implemented in the Switching Fabric.

Abstract: A Resource reSerVation Protocol (RSVP) transmitter proxy reserves network resources on behalf of a multimedia server that lacks RSVP facilities. The RSVP transmitter proxy is preferably disposed in an intermediate network device that is proximate to (e.g., one hop away from) the respective server, and includes a classification engine configured to identify network traffic passing through the network device, and a media session manager for maintaining state and other information for streams and/or sessions being provided by the server. The classification engine may snoop messages exchanged between the server and a client to identify the traffic flow characteristics and bandwidth of a stream. The RSVP transmitter uses the snooped information to generate and send RSVP Path messages on behalf of the server and to terminate RSVP Reservation messages sent to the server, thereby causing network resources to be reserved for the stream.

Abstract: A method that rapidly reconfigures a computer network having a plurality of devices executing the spanning tree algorithm. First, one or more devices are configured and arranged so that one port, providing connectivity to the root, is in the forwarding state and the remaining ports, providing connectivity to the root, are in the blocked state. Next, one or more of the blocked ports are designated as back-up ports. Upon detection of a failure at the active forwarding port, one of the back-up ports immediately transitions from blocked to forwarding, thereby becoming the new active port for the device. Following the transition to a new active port, dummy multicast messages are transmitted, each containing the source address of an entity directly coupled to the affected device or downstream thereof. By examining the dummy multicast messages, other devices in the network learn to use to the new forwarding port of the affected device.