Abstract: To avoid packet out-of-sequence problems, while providing good load balancing, each input port of a switch monitors the outstanding number of packets for each flow group. If there is an outstanding packet in the switch fabric, the following packets of the same flow group should follow the same path. If there is no outstanding packet of the same flow group in the switch fabric, the (first, and therefore subsequent) packets of the flow can choose a less congested path to improve load balancing performance without causing an out-of-sequence problem. To avoid HOL blocking without requiring too many queues, an input module may include two stages of buffers. The first buffer stage may be a virtual output queue (VOQ) and second buffer stage may be a virtual path queue (VPQ). At the first stage, the packets may be stored at the VOQs, and the HOL packet of each VOQ may be sent to the VPQ. By allowing each VOQ to send at most one packet to VPQ, HOL blocking can be mitigated dramatically.

Abstract: For a survivable portion of a network, a backup port for a first router of the survivable network, to reach a destination node in the event of a single node failure, may be determined by (a) accepting a routing path graph having the destination node, wherein the routing path graph includes one or more links terminated by one or more primary ports of the first router; and (b) for each router of at least a part of the routing path graph, (1) assuming that the current router is removed, defining (A) a first part of the routing path graph including the destination node, and (B) a second part of the routing path graph separated from the first part wherein the second part defines one or more sub-graphs, and (2) determining the backup port for the first router by examining at least one of the one or more sub-graphs to find a link to the first part of the routing path graph.

Abstract: For a survivable portion of a network, a backup port for a first router of the survivable network, to reach a destination node in the event of a single link failure, may be determined by (a) accepting a routing path graph having the destination node, wherein the routing path graph includes one or more links terminated by one or more primary ports of the first router, and (b) for each router of at least a part of the routing path graph, (1) assuming that a link terminated by a primary port of the current router is removed, defining (A) a first part of the routing path graph including the destination node, and (B) a second part of the routing path graph separated from the first part wherein the second part defines a sub-graph, and (2) determining the backup port for the first router by examining the sub-graph with respect to the first part of the routing path graph.

Abstract: Practical packet reassembly in large, multi-plane, multi-stage switches is possible by using a scheduling technique called dynamic packet interleaving. With dynamic packet interleaving scheduling, if more than one packet is contending for the same output link in a switch module, an arbiter in the switch module gives priority to a partial packet (i.e., to a packet that has had at least one cell sent to the queue). The number of reassembly queues required to ensure reassembly is dramatically reduced (e.g., to the number of paths multiplied by the number of scheduling priorities). Deadlock may be avoided by guaranteeing (e.g., reserving) at least one cell space for all partial packets.

Abstract: A router in a survivable portion of a network may forward packets to a destination node even in the event of a double-link failure. For a given destination node, the router has previously been configured with a primary port, a primary backup port, and a secondary backup port. The router receives a packet addressed to the destination node within the survivable portion of the network, wherein the packet includes information indicating that the packet has encountered a failure. The router then selects one of (A) the primary port, (B) the primary backup port and (C) the secondary backup port on which to forward the received packet, such that a backup path with no dead loops is defined. The router may obtain a recovery distance of at least one of (A) the primary backup port based on a backup path to which it leads, and (B) the secondary backup port based on a backup path to which it leads, and may further obtain counter information in a packet indicative of a failure distance.

Abstract: To use the memory space more effectively, cell memory can be shared by an input link and all output links. To prevent one flow from occupying the entire memory space, a threshold may be provided for the queue. The queue threshold may accommodate the RTT delay of the link. Queue length information about a downstream switch module may be sent to an upstream switch module via cell headers in every credit update period per link. Cell and/or credit loss may be recovered from. Increasing the credit update period reduces the cell header bandwidth but doesn't degrade performance significantly. Sending a credit per link simplifies implementation and eliminates interference between other links.

Abstract: Packets out-of-sequence problem can be solved by using a window flow control scheme that can dispatch traffic at the cell level, in a round robin fashion, as evenly as possible. Each VOQ at the input port has a sequence head pointer that is used to assign sequence numbers (SN) to the cells. Also a sequence tail pointer is available at each VOQ that is used to acknowledge and limit the amount of cells that can be sent to the output ports based on the window size of the scheme. Each VIQ at the output port has a sequence pointer or sequence number (SN) pointer that indicates to the VIQ which cell to wait for. Once the VIQ receives the cell that the SN pointer indicated, the output port sends an ACK packet back to the input port. By using sequence numbers and the relevant pointers, the packet out-of-sequence problem is solved.

Abstract: Backup ports for a first router of the survivable network are determined so that the first router can reach a destination node in the event of a double link failure. A routing path graph having the destination node is accepted. The routing path graph includes one or more links terminated by one or more primary ports of the first router. For each router of at least a part of the routing path graph, assuming that a link terminated by a primary port of the first router is removed, a first part of the routing path graph including the destination node and a second part of the routing path graph (sub-graph) separated from the first part are defined. Two exits for the sub-graph to reach the graph are determined. A primary backup port and a secondary backup port are determined for the first router using the determined two exits.

Abstract: Packet-level multicasting may be used to avoid the cell header and the memory size problems. One or more multicast control cells may be appended before one or more data cells of a multicast packet to carry multicast bitmap information. The control cell may be stored at the cell memory. This approach is suitable for a multi-plane, multi-stage packet switch.

Abstract: Packets out-of-sequence problem can be solved by using a window flow control scheme that can dispatch traffic at the cell level, in a round robin fashion, as evenly as possible. Each VOQ at the input port has a sequence head pointer that is used to assign sequence numbers (SN) to the cells. Also a sequence tail pointer is available at each VOQ that is used to acknowledge and limit the amount of cells that can be sent to the output ports based on the window size of the scheme. Each VIQ at the output port has a sequence pointer or sequence number (SN) pointer that indicates to the VIQ which cell to wait for. Once the VIQ receives the cell that the SN pointer indicated, the output port sends an ACK packet back to the input port. By using sequence numbers and the relevant pointers, the packet out-of-sequence problem is solved.

Abstract: In a network including a centralized controller and a plurality of routers forming a security perimeter, a method for selectively discarding packets during a distributed denial-of-service (DDoS) attack over the network. The method includes aggregating victim destination prefix lists and attack statistics associated with incoming packets received from the plurality of routers to confirm a DDoS attack victim, and aggregating packet attribute distribution frequencies for incoming victim related packets received from the plurality of security perimeter routers. Common scorebooks are generated from the aggregated packet attribute distribution frequencies and nominal traffic profiles, and local cumulative distribution function (CDF) of the local scores derived from the plurality of security perimeter routers are aggregated.

Abstract: For a survivable portion of a network, a backup port for a first router of the survivable network, to reach a destination node in the event of a single node failure, may be determined by (a) accepting a routing path graph having the destination node, wherein the routing path graph includes one or more links terminated by one or more primary ports of the first router; and (b) for each router of at least a part of the routing path graph, (1) assuming that the current router is removed, defining (A) a first part of the routing path graph including the destination node, and (B) a second part of the routing path graph separated from the first part wherein the second part defines one or more sub-graphs, and (2) determining the backup port for the first router by examining at least one of the one or more sub-graphs to find a link to the first part of the routing path graph.

Abstract: Backup ports for a first router of the survivable network are determined so that the first router can reach a destination node in the event of a double link failure. A routing path graph having the destination node is accepted. The routing path graph includes one or more links terminated by one or more primary ports of the first router. For each router of at least a part of the routing path graph, assuming that a link terminated by a primary port of the first router is removed, a first part of the routing path graph including the destination node and a second part of the routing path graph (sub-graph) separated from the first part are defined. Two exits for the sub-graph to reach the graph are determined. A primary backup port and a secondary backup port are determined for the first router using the determined two exits.

Abstract: A router in a survivable portion of a network may forward packets to a destination node even in the event of a double-link failure. For a given destination node, the router has previously been configured with a primary port, a primary backup port, and a secondary backup port. The router receives a packet addressed to the destination node within the survivable portion of the network, wherein the packet includes information indicating that the packet has encountered a failure. The router then selects one of (A) the primary port, (B) the primary backup port and (C) the secondary backup port on which to forward the received packet, such that a backup path with no dead loops is defined. The router may obtain a recovery distance of at least one of (A) the primary backup port based on a backup path to which it leads, and (B) the secondary backup port based on a backup path to which it leads, and may further obtain counter information in a packet indicative of a failure distance.

Abstract: Effective control of communications traffic, even under fast-changing DDoS attacks, might be performed by (a) determining parameters of a leaky bucket using nominal communications traffic, (b) applying current communications traffic to the leaky bucket, (c) observing overflows, if any, of the leaky bucket, (d) scoring the current traffic based on the observed overflows, and (e) passing or dropping traffic based on the score. Alternatively, such control might be performed by (a) determining average mean and variance of each of one or more attribute values of nominal communications traffic, (b) determining a mean of each of the one or more attribute values of current communications traffic, (c) determining a probability that for each of the one or more attributes, its current mean value deviates more from its average mean that its current attribute value, (d) scoring the current traffic based on the determined probability or probabilities, and (e) passing or dropping traffic based on the score.

Abstract: An exhaustive service dual round-robin matching (EDRRM) arbitration process amortizes the cost of a match over multiple time slots. It achieves high throughput under nonuniform traffic. Its delay performance is not sensitive to traffic burstiness, switch size and packet length. Since cells belonging to the same packet are transferred to the output continuously, packet delay performance is improved and packet reassembly is simplified.

Abstract: A multiple phase cell dispatch scheme, in which each phase uses a simple and fair (e.g., round robin) arbitration methods, is described. VOQs of an input module and outgoing links of the input module are matched in a first phase. An outgoing link of an input module is matched with an outgoing link of a central module in a second phase. The arbiters become desynchronized under stable conditions which contributes to the switch's high throughput characteristic. Using this dispatch scheme, a scalable multiple-stage switch able to operate at high throughput, without needing to resort to speeding up the switching fabric and without needing to use buffers in the second stage, is possible. The cost of speed-up and the cell out-of-sequence problems that may occur when buffers are used in the second stage are therefore avoided.

Abstract: A multiple phase cell dispatch scheme, in which each phase uses a simple and fair (e.g., round robin) arbitration methods, is described. VOQs of an input module and outgoing links of the input module are matched in a first phase. An outgoing link of an input module is matched with an outgoing link of a central module in a second phase. The arbiters become desynchronized under stable conditions which contributes to the switch's high throughput characteristic. Using this dispatch scheme, a scalable multiple-stage switch able to operate at high throughput, without needing to resort to speeding up the switching fabric and without needing to use buffers in the second stage, is possible. The cost of speed-up and the cell out-of-sequence problems that may occur when buffers are used in the second stage are therefore avoided. A hierarchical arbitration scheme used in the input modules reduces the time needed for scheduling and reduces connection lines.

Abstract: A pipeline-based matching scheduling approach for input-buffered switches relaxes the timing constraint for arbitration with matching schemes, such as CRRD and CMSD. In the new approach, arbitration may operate in a pipelined manner. Each sub-scheduler is allowed to take more than one time slot for its matching. Every time slot, one of them provides a matching result(s). The sub-scheduler can use a matching scheme such as CRRD and CMSD.

Abstract: A pipeline-based matching scheduling approach for input-buffered switches relaxes the timing constraint for arbitration with matching schemes, such as CRRD and CMSD. In the new approach, arbitration may operate in a pipelined manner. Each sub-scheduler is allowed to take more than one time slot for its matching. Every time slot, one of them provides a matching result(s). The sub-scheduler can use a matching scheme such as CRRD and CMSD.