Abstract: A networking system may include one or more network nodes such as one or more network switches. The network switches include respective matching engines. The matching engines across the network switches may be configured to match on a consistent set of matching criteria based on low and high entropy data fields to sample a same subset of packets for each network flow of interest. The sampled packets may include annotations and may be sent to collector circuitry for analysis. Controller circuitry may enforce consistent sampling policies across the network switches.

Abstract: Embodiments of the present disclosure include a pluggable optical line system module for amplification, multiplexing, and demultiplexing of coherent optical signals that can be integrated with a switch-router. Integration may include mechanical, electrical, and software control aspects. One example embodiment of the optical line system is in an industry standard small form factor pluggable module such as OSFP (octal small form factor pluggable) or QSFP (quad small form factor pluggable). When configured in a switch-router, the pluggable optical line is powered, managed and controlled by the switch-router which greatly reduces the cost, space, power and the management complexity of optical line systems.

Abstract: A networking system may include one or more network nodes such as one or more network switches. The network switches include respective matching engines. The matching engines across the network switches may be configured to match on a consistent set of matching criteria based on low and high entropy data fields to sample a same subset of packets for each network flow of interest. The sampled packets may include annotations and may be sent to collector circuitry for analysis. Controller circuitry may enforce consistent sampling policies across the network switches.

Abstract: Embodiments of the present disclosure include a pluggable optical line system module for amplification, multiplexing, and demultiplexing of coherent optical signals that can be integrated with a switch-router. Integration may include mechanical, electrical, and software control aspects. One example embodiment of the optical line system is in an industry standard small form factor pluggable module such as OSFP (octal small form factor pluggable) or QSFP (quad small form factor pluggable). When configured in a switch-router, the pluggable optical line is powered, managed and controlled by the switch-router which greatly reduces the cost, space, power and the management complexity of optical line systems.

Abstract: Embodiments of the present disclosure include a pluggable optical line system module for amplification, multiplexing, and demultiplexing of coherent optical signals that can be integrated with a switch-router. Integration may include mechanical, electrical, and software control aspects. One example embodiment of the optical line system is in an industry standard small form factor pluggable module such as OSFP (octal small form factor pluggable) or QSFP (quad small form factor pluggable). When configured in a switch-router, the pluggable optical line is powered, managed and controlled by the switch-router which greatly reduces the cost, space, power and the management complexity of optical line systems.

Abstract: Embodiments of the present disclosure include a pluggable optical line system module for amplification, multiplexing, and demultiplexing of coherent optical signals that can be integrated with a switch-router. Integration may include mechanical, electrical, and software control aspects. One example embodiment of the optical line system is in an industry standard small form factor pluggable module such as OSFP (octal small form factor pluggable) or QSFP (quad small form factor pluggable). When configured in a switch-router, the pluggable optical line is powered, managed and controlled by the switch-router which greatly reduces the cost, space, power and the management complexity of optical line systems.

Abstract: In general, embodiments of the invention relate to processing network traffic data units (NTDUs). More specifically, embodiments of the invention relate to processing NTDUs transmitted between client device and the one or more protected resources. The protected resources are logically surrounded by a perimeter, which is implemented as a set of network devices that manage the flow of NTDUs between client devices and the protected resources. The perimeter works in conjunction with a set of filtering devices to determine whether a given NTDU can ultimately be transmitted to, and processed by, a protected resource.

Abstract: In general, embodiments of the invention relate to processing network traffic data units (NTDUs). More specifically, embodiments of the invention relate to processing NTDUs transmitted between client device and the one or more protected resources. The protected resources are logically surrounded by a perimeter, which is implemented as a set of network devices that manage the flow of NTDUs between client devices and the protected resources. The perimeter works in conjunction with a set of filtering devices to determine whether a given NTDU can ultimately be transmitted to, and processed by, a protected resource.

Abstract: Various embodiments of a network element comprising a control plane including stream tracer logic are described herein. The network element additionally includes a data plane coupled to the control plane, where the data plane includes forwarding logic to forward a unit of network data from an ingress interface to an egress interface. The stream tracer logic can be configured to cause marking logic to mark selected units of network data for to be counted by counting logic and to cause the counting logic to count marked units of network data. The stream tracer logic can determine whether units of network data are dropped within the forwarding logic via comparison of an ingress count of the marked units of network data with an egress count of the marked units of network data.

Abstract: Various embodiments of a network element comprising a control plane including stream tracer logic are described herein. The network element additionally includes a data plane coupled to the control plane, where the data plane includes forwarding logic to forward a unit of network data from an ingress interface to an egress interface. The stream tracer logic can be configured to cause marking logic to mark selected units of network data for to be counted by counting logic and to cause the counting logic to count marked units of network data. The stream tracer logic can determine whether units of network data are dropped within the forwarding logic via comparison of an ingress count of the marked units of network data with an egress count of the marked units of network data.

Abstract: Various embodiments of a network element comprising a control plane including stream tracer logic are described herein. The network element additionally includes a data plane coupled to the control plane, where the data plane includes forwarding logic to forward a unit of network data from an ingress interface to an egress interface. The stream tracer logic can be configured to cause marking logic to mark selected units of network data for to be counted by counting logic and to cause the counting logic to count marked units of network data. The stream tracer logic can determine whether units of network data are dropped within the forwarding logic via comparison of an ingress count of the marked units of network data with an egress count of the marked units of network data.

Abstract: Various embodiments of a network element comprising a control plane including stream tracer logic are described herein. The network element additionally includes a data plane coupled to the control plane, where the data plane includes forwarding logic to forward a unit of network data from an ingress interface to an egress interface. The stream tracer logic can be configured to cause marking logic to mark selected units of network data for to be counted by counting logic and to cause the counting logic to count marked units of network data. The stream tracer logic can determine whether units of network data are dropped within the forwarding logic via comparison of an ingress count of the marked units of network data with an egress count of the marked units of network data.

Abstract: A system for managing bandwidth use in a device. In a specific embodiment, the device is a network device that includes a first data scheduler that is adapted to initially share available device bandwidth among a first type of traffic and a second type of traffic on an as-needed basis. A traffic monitor communicates with the first scheduler and causes the first data scheduler to guarantee predetermined transmission characteristics for the second type of traffic. The first data scheduler includes one or more routines for prioritizing first type of traffic above the second type of traffic when the network device is in a first operational mode, and prioritizing the second type of traffic above the first type of traffic when the network device is in a second operation al mode. The minimum transmission characteristics include a minimum service rate and a minimum latency for the second type of traffic.

Abstract: Access devices and methods according to the invention interconnect digital devices and a network. Setting a parameter associated with each input port of an access device specifies whether the device connected with that port is restricted or unrestricted. When a particular input port is restricted, packet detectors examine the packets received on that port. In some embodiments, an exception handler handles restricted packets from restricted devices in an advantageously flexible manner. In other embodiments, a controller receives a configuration command and sets the restriction parameters accordingly. The invention provides a simple, abstract, easy to use, and flexible tool for network management, configuration, and reconfiguration.

Abstract: Methods and systems for distributing packets across all available output paths within a network is provided. A distribution key is extracted from each packet and is hashed to generate a hash value. An output path for each packet is selected by using all N bits of the hash value to address a distribution table having at least 2N indications of the output paths available for that packet. Thus, the stream of packets is distributed, or split up, across the available output paths, thereby balancing the load. In some embodiments, the order of the output paths is randomized within each distribution table. Other embodiments include a forwarding table used to determine the available output paths for a particular packet. In yet other embodiments, the distribution key includes the packet's source and destination; thus preventing packets within the same stream having varying latencies due to traveling along varying paths.

Abstract: A system for managing bandwidth use in a device. In a specific embodiment, the device is a network device that includes a first data scheduler that is adapted to initially share available device bandwidth among a first type of traffic and a second type of traffic on an as-needed basis. A traffic monitor communicates with the first scheduler and causes the first data scheduler to guarantee predetermined transmission characteristics for the second type of traffic. The first data scheduler includes one or more routines for prioritizing first type of traffic above the second type of traffic when the network device is in a first operational mode, and prioritizing the second type of traffic above the first type of traffic when the network device is in a second operation al mode. The minimum transmission characteristics include a minimum service rate and a minimum latency for the second type of traffic.

Abstract: Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms for maintaining counters, such as in, but not limited to a packet switching system, and updating a secondary counter storage based on values of the counters and entries in an overflow buffer. Multiple counter values are stored in a counter bank. An indication of a particular counter of the multiple counters to update is received. A current value of the particular counter is updated in the counter bank, and if an overflow condition results, then an indication of the particular counter is added to an overflow buffer. Periodically each of the multiple counters is visited and corresponding values are updated in a secondary storage, and each entry is retrieved from the overflow buffer and a corresponding value is updated in the secondary storage.

Abstract: A method and system transforms one or more lists for a data communications system into a single list, each list of the one or more lists including a plurality of entries. The method includes removing non-terminating entries from the plurality of entries in the one or more lists, the removing each non-terminating entry removing all but a last non-terminating entry in any of the one or more lists; and eliminating from the plurality of entries one or more entries that provide for one or more impossible actions, wherein the removing of non-terminating entries and the eliminating of one or more entries that provide for impossible actions, if any, produce a single list preserving tracing of the entries in the single list to the plurality of entries.

Abstract: Access devices and methods according to the invention interconnect digital devices and a network. Setting a parameter associated with each input port of an access device specifies whether the device connected with that port is restricted or unrestricted. When a particular input port is restricted, packet detectors examine the packets received on that port. In some embodiments, an exception handler handles restricted packets from restricted devices in an advantageously flexible manner. In other embodiments, a controller receives a configuration command and sets the restriction parameters accordingly. The invention provides a simple, abstract, easy to use, and flexible tool for network management, configuration, and reconfiguration.

Abstract: Methods and systems for distributing packets across all available output paths within a network is provided. A distribution key is extracted from each packet and is hashed to generate a hash value. An output path for each packet is selected by using all N bits of the hash value to address a distribution table having at least 2N indications of the output paths available for that packet. Thus, the stream of packets is distributed, or split up, across the available output paths, thereby balancing the load. In some embodiments, the order of the output paths is randomized within each distribution table. Other embodiments include a forwarding table used to determine the available output paths for a particular packet. In yet other embodiments, the distribution key includes the packet's source and destination; thus preventing packets within the same stream having varying latencies due to traveling along varying paths.