Abstract: In general, techniques are described for providing an isolation virtual local area network (VLAN) for layer two access networks. A server comprising an interface and a control unit may implement the techniques. The interface receives a message that initiates a request for a layer three (L3) network address for use by a client device via an isolation virtual local area network (VLAN) that supports transmitting data from a network device to the server, where the network device is intermediately positioned between the client device and the server. The message includes a layer two (L2) address associated with the client device. The control unit determines whether to allow the client device to access the network and assigns the L3 network address to the client device based on the determination.

Abstract: In general, this disclosure describes network security techniques that may accommodate legitimate movement of a subscriber device while preventing MAC collisions that may result from configuration errors or MAC spoofing attempts. MAC spoofing may result in packets directed to one subscriber device being sent instead to another subscriber device. By modifying an access node or a Dynamic Host Configuration Protocol (DHCP) server to allow only authorized subscriber devices on the access network, layer two collisions (“MAC collisions”) may be prevented.

Abstract: In general, techniques are described for inline packet replication in network devices. A network device referred to as an optical line terminal (OLT) may implement the techniques. The OLT comprises a customer interface that supports different logical interfaces to which couple a plurality of optical network terminals (ONTs) and a network interface that receives a data unit. The OLT further comprises a conversion unit, such as a media access control (MAC) module, located in a data path of the optical line terminal that determines whether the received data unit is a candidate for replication. The conversion unit includes an inline packet processing module that performs replication to generate at least one copy of the data unit based on the determination that the received packet is a candidate for packet replication. The customer interface outputs the at least one copy of the data unit to the ONTs.

Abstract: The disclosure presents techniques for merging multiple data flows in a network such as a Passive Optical Network (PON). The PON comprises an interface module and network nodes connected to the interface module via an optical fiber link. Each network node further serves client devices. The client devices request multiple data flows, requiring the interface module to serve multiple data flows to a network node for delivery to the devices. The interface module merges received data flows to permit multiple flows to be processed by a single segmentation and reassembly (SAR) engine, reducing hardware cost and complexity within the node. However, subunits associated with different data flows within a merged data flow are not interleaved with one another. Instead, the subunits associated with an original unit of information are transmitted contiguously within the merged data flow, facilitating identification and reassembly of the subunits for a particular microflow.

Abstract: In general, this disclosure describes network security techniques that may accommodate legitimate movement of a subscriber device while preventing MAC collisions that may result from configuration errors or MAC spoofing attempts. MAC spoofing may result in packets directed to one subscriber device being sent instead to another subscriber device. By modifying an access node or a Dynamic Host Configuration Protocol (DHCP) server to allow only authorized subscriber devices on the access network, layer two collisions (“MAC collisions”) may be prevented.

Abstract: In general, techniques are described for inline packet replication in network devices. A network device referred to as an optical line terminal (OLT) may implement the techniques. The OLT comprises a customer interface that supports different logical interfaces to which couple a plurality of optical network terminals (ONTs) and a network interface that receives a data unit. The OLT further comprises a conversion unit, such as a media access control (MAC) module, located in a data path of the optical line terminal that determines whether the received data unit is a candidate for replication. The conversion unit includes an inline packet processing module that performs replication to generate at least one copy of the data unit based on the determination that the received packet is a candidate for packet replication. The customer interface outputs the at least one copy of the data unit to the ONTs.

Abstract: In general, techniques are described for providing an isolation virtual local area network (VLAN) for layer two access networks. A server comprising an interface and a control unit may implement the techniques. The interface receives a message that initiates a request for a layer three (L3) network address for use by a client device via an isolation virtual local area network (VLAN) that supports transmitting data from a network device to the server, where the network device is intermediately positioned between the client device and the server. The message includes a layer two (L2) address associated with the client device. The control unit determines whether to allow the client device to access the network and assigns the L3 network address to the client device based on the determination.

Abstract: In general, techniques are described for inline packet replication in network devices. A network device referred to as an optical line terminal (OLT) may implement the techniques. The OLT comprises a customer interface that supports different logical interfaces to which couple a plurality of optical network terminals (ONTs) and a network interface that receives a data unit. The OLT further comprises a conversion unit, such as a media access control (MAC) module, located in a data path of the optical line terminal that determines whether the received data unit is a candidate for replication. The conversion unit includes an inline packet processing module that performs replication to generate at least one copy of the data unit based on the determination that the received packet is a candidate for packet replication. The customer interface outputs the at least one copy of the data unit to the ONTs.

Abstract: Techniques for reestablishing network address associations upon recovery of a passive optical network (PON) disablement rely on storage address association information. A network node stores address association information in non-volatile memory upon detecting a network disablement. Upon recovery of the PON from the disablement, the network node associates network addresses to clients in accordance with the address association information. The network node may further verify the associations by sending ARP queries for the network addresses to the associated clients. Alternatively, the network nodes may reestablish the address associations by tracking the length of time of the network disablement, and updating address association information in accordance with the length of the disablement.

Abstract: The disclosure presents techniques for merging multiple data flows in a network such as a Passive Optical Network (PON). The PON comprises an interface module and network nodes connected to the interface module via an optical fiber link. Each network node further serves client devices. The client devices request multiple data flows, requiring the interface module to serve multiple data flows to a network node for delivery to the devices. The interface module merges received data flows to permit multiple flows to be processed by a single segmentation and reassembly (SAR) engine, reducing hardware cost and complexity within the node. However, subunits associated with different data flows within a merged data flow are not interleaved with one another. Instead, the subunits associated with an original unit of information are transmitted contiguously within the merged data flow, facilitating identification and reassembly of the subunits for a particular microflow.

Abstract: In general, this disclosure describes network security techniques that may accommodate legitimate movement of a subscriber device while preventing MAC collisions that may result from configuration errors or MAC spoofing attempts. MAC spoofing may result in packets directed to one subscriber device being sent instead to another subscriber device. By modifying an access node or a Dynamic Host Configuration Protocol (DHCP) server to allow only authorized subscriber devices on the access network, layer two collisions (“MAC collisions”) may be prevented.

Abstract: In general, this disclosure describes network security techniques that may accommodate legitimate movement of a subscriber device while preventing MAC collisions that may result from configuration errors or MAC spoofing attempts. MAC spoofing may result in packets directed to one subscriber device being sent instead to another subscriber device. By modifying an access node or a Dynamic Host Configuration Protocol (DHCP) server to allow only authorized subscriber devices on the access network, layer two collisions (“MAC collisions”) may be prevented.

Abstract: The disclosure presents techniques for merging multiple data flows in a network such as a Passive Optical Network (PON). The PON comprises an interface module and network nodes connected to the interface module via an optical fiber link. Each network node further serves client devices. The client devices request multiple data flows, requiring the interface module to serve multiple data flows to a network node for delivery to the devices. The interface module merges received data flows to permit multiple flows to be processed by a single segmentation and reassembly (SAR) engine, reducing hardware cost and complexity within the node. However, subunits associated with different data flows within a merged data flow are not interleaved with one another. Instead, the subunits associated with an original unit of information are transmitted contiguously within the merged data flow, facilitating identification and reassembly of the subunits for a particular microflow.

Abstract: The disclosure is directed to techniques for merging multiple data flows in a Passive Optical Network (PON). The PON comprises an interface module and a plurality of network nodes connected to the interface module via an optical fiber link. Each of the network nodes further serves client devices. The client devices request multiple data flows, requiring the interface module to serve multiple data flows to a network node for delivery to the devices. The interface module merges received data flows to permit multiple flows to be processed by a single segmentation and reassembly (SAR) engine, reducing hardware cost and complexity within the node. However, subunits associated with different data flows within a merged data flow are not interleaved with one another. Instead, the subunits associated with an original unit of information are transmitted contiguously within the merged data flow, facilitating identification and reassembly of the subunits for a particular microflow.

Abstract: The disclosure presents techniques for merging multiple data flows in a network such as a Passive Optical Network (PON). The PON comprises an interface module and network nodes connected to the interface module via an optical fiber link. Each network node further serves client devices. The client devices request multiple data flows, requiring the interface module to serve multiple data flows to a network node for delivery to the devices. The interface module merges received data flows to permit multiple flows to be processed by a single segmentation and reassembly (SAR) engine, reducing hardware cost and complexity within the node. However, subunits associated with different data flows within a merged data flow are not interleaved with one another. Instead, the subunits associated with an original unit of information are transmitted contiguously within the merged data flow, facilitating identification and reassembly of the subunits for a particular microflow.

Abstract: Techniques for reestablishing network address associations upon recovery of a passive optical network (PON) disablement relay on storage address association information. A network node stores address association information in non-volatile memory upon detecting a network disablement. Upon recovery of the PON from the disablement, the network node associates network addresses to clients in accordance with the address association information. The network node may further verify the associations by sending ARP queries for the network addresses to the associated clients. Alternatively, the network nodes may reestablish the address associations by tracking the length of time of the network disablement, and updating address association information in accordance with the length of the disablement.

Abstract: Techniques for reestablishing network address associations upon recovery of a passive optical network (PON) disablement relay on storage address association information. A network node stores address association information in non-volatile memory upon detecting a network disablement. Upon recovery of the PON from the disablement, the network node associates network addresses to clients in accordance with the address association information. The network node may further verify the associations by sending ARP queries for the network addresses to the associated clients. Alternatively, the network nodes may reestablish the address associations by tracking the length of time of the network disablement, and updating address association information in accordance with the length of the disablement.

Abstract: In general, the disclosure presents techniques for creating and maintaining routing information within a passive optical network. A PON interface receives a DHCP request to obtain a network address from a client represented by a node. The PON interface maps a particular interface module on which the client resides to unique client information, e.g., a media access control (MAC) address or other identifier, included in the DHCP request. The PON interface forwards the request to a DHCP server that returns a DHCP response indicating an administered IP address and lease time for the requesting client. Upon receipt of the DHCP response, the PON interface updates the mapping to create routing information for routing packets to the administered addresses. For example, PON interface may map the administered IP address to the particular interface module on which the client resides.

Abstract: An interface module of a Passive Optical Network (PON) maintains information associating Class-D Internet Protocol (IP) addresses for multicast streams with Asynchronous Transfer Mode (ATM) Virtual Circuit Channels (VCCs), and with nodes of the PON that have requested the multicast streams. When an interface module receives a first request for a multicast stream, it will associate a VCC and the requesting node with a Class-D IP address of the stream and deliver the stream on the associated VCC. The interface module may periodically deliver map packets to nodes to indicate the current Class-D IP to VCC mappings, and subsequent requesting nodes may obtain the stream by referring to the map packet. The interface module deletes the association of a node with a stream when it receives a disassociation request from the node, and delivers the stream on the associated VCC so long as any node is associated with the stream.