Abstract: In a network including a centralized controller and a plurality of routers forming a security perimeter, a method for selectively discarding packets during a distributed denial-of-service (DDoS) attack over the network. The method includes aggregating victim destination prefix lists and attack statistics associated with incoming packets received from the plurality of routers to confirm a DDoS attack victim, and aggregating packet attribute distribution frequencies for incoming victim related packets received from the plurality of security perimeter routers. Common scorebooks are generated from the aggregated packet attribute distribution frequencies and nominal traffic profiles, and local cumulative distribution function (CDF) of the local scores derived from the plurality of security perimeter routers are aggregated.

Abstract: To avoid packet out-of-sequence problems, while providing good load balancing, each input port of a switch monitors the outstanding number of packets for each flow group. If there is an outstanding packet in the switch fabric, the following packets of the same flow group should follow the same path. If there is no outstanding packet of the same flow group in the switch fabric, the (first, and therefore subsequent) packets of the flow can choose a less congested path to improve load balancing performance without causing an out-of-sequence problem. To avoid HOL blocking without requiring too many queues, an input module may include two stages of buffers. The first buffer stage may be a virtual output queue (VOQ) and second buffer stage may be a virtual path queue (VPQ). At the first stage, the packets may be stored at the VOQs, and the HOL packet of each VOQ may be sent to the VPQ. By allowing each VOQ to send at most one packet to VPQ, HOL blocking can be mitigated dramatically.

Abstract: A dual round robin arbitration technique for a switch in which input ports include virtual output queues. A first arbitration selects, for each of the input ports, one cell from among head of line cells of the virtual output queues to generate a first arbitration winning cell. Then, for each of the output ports, a second arbitration selects one cell from among the first arbitration winning cells requesting the output port.

Abstract: An exhaustive service dual round-robin matching (EDRRM) arbitration process amortizes the cost of a match over multiple time slots. It achieves high throughput under nonuniform traffic. Its delay performance is not sensitive to traffic burstiness, switch size and packet length. Since cells belonging to the same packet are transferred to the output continuously, packet delay performance is improved and packet reassembly is simplified.

Abstract: A pipeline-based matching scheduling approach for input-buffered switches relaxes the timing constraint for arbitration with matching schemes, such as CRRD and CMSD. In the new approach, arbitration may operate in a pipelined manner. Each sub-scheduler is allowed to take more than one time slot for its matching. Every time slot, one of them provides a matching result(s). The sub-scheduler can use a matching scheme such as CRRD and CMSD.

Abstract: A hierarchical arbitration method in which requests are grouped, using a logical OR operation for example, and provided to higher levels of the hierarchy. Then, grant signals from higher levels of the hierarchy are either propagated down through each level of the hierarchy where they are used to modify, using a logical AND operation for example, grant signals. Alternatively, grant signals from all higher levels of the hierarchy may be provided to a leaf layer of the hierarchy where they are all used to modify, using a logical AND operation for example, grant signals.

Abstract: In a switch having input ports and output ports, a fast ring reservation arbitration is provided by grouping crosspoint units associated with an output port. If any of the crosspoint units of a group request the output port, a received token will be passed to crosspoint units within the group. If, on the other hand, none of the crosspoint units of a group request the output port, then a received token will bypass the group and be forwarded to a next group.

Abstract: A pipeline-based matching scheduling approach for input-buffered switches relaxes the timing constraint for arbitration with matching schemes, such as CRRD and CMSD. In the new approach, arbitration may operate in a pipelined manner. Each sub-scheduler is allowed to take more than one time slot for its matching. Every time slot, one of them provides a matching result(s). The sub-scheduler can use a matching scheme such as CRRD and CMSD.

Abstract: A multiple phase cell dispatch scheme, in which each phase uses a simple and fair (e.g., round robin) arbitration methods, is described. VOQs of an input module and outgoing links of the input module are matched in a first phase. An outgoing link of an input module is matched with an outgoing link of a central module in a second phase. The arbiters become desynchronized under stable conditions which contributes to the switch's high throughput characteristic. Using this dispatch scheme, a scalable multiple-stage switch able to operate at high throughput, without needing to resort to speeding up the switching fabric and without needing to use buffers in the second stage, is possible. The cost of speed-up and the cell out-of-sequence problems that may occur when buffers are used in the second stage are therefore avoided. A hierarchical arbitration scheme used in the input modules reduces the time needed for scheduling and reduces connection lines.

Abstract: A multiple phase cell dispatch scheme, in which each phase uses a simple and fair (e.g., round robin) arbitration methods, is described. VOQs of an input module and outgoing links of the input module are matched in a first phase. An outgoing link of an input module is matched with an outgoing link of a central module in a second phase. The arbiters become desynchronized under stable conditions which contributes to the switch's high throughput characteristic. Using this dispatch scheme, a scalable multiple-stage switch able to operate at high throughput, without needing to resort to speeding up the switching fabric and without needing to use buffers in the second stage, is possible. The cost of speed-up and the cell out-of-sequence problems that may occur when buffers are used in the second stage are therefore avoided.

Abstract: A hierarchical searching technique is used to find the first memory location of a calendar queue with a validity bit of “1” (that is, the lowest time stamp). The bit string at any level l (l≠0) can be stored in a RAM of size glMl−1. The string at the highest level in the hierarchy (l=0) can be stored in an M0 bit register.

Abstract: A two (2) dimensional shaper uses a hierarchical searching technique to find the first memory location of the calendar queue with a validity bit of “1” (that is, the lowest time stamp). The bit string at any level l (l≠0) can be stored in a RAM of size glMl−1. The string at the highest level in the hierarchy (l=0) can be stored in an M0 bit register.

Abstract: Compensating for time stamp aging in systems employing fair packet queuing algorithms by (i) representing a time stamp of each head-of-line packet of a session with a finite number of bits, (ii) representing a system potential with a finite number of bits, (iii) storing a packet's time stamp when it is served, (iv) storing an obsolete indicator for each stored time stamp, and (v) updating the obsolete indicator or purging obsolete time stamps.

Abstract: An application specific integrated circuit (or "ASIC") chip for building a scaleable, multicast, asynchronous transfer mode (or "ATM") switch having on the order of 100 to a few thousand input and output ports. The ATM switch has a regular structure and may be easily expanded. Furthermore, the ATM switch permits synchronization for data and clock signals to be relaxed. Moreover, the switch system may be built using economic CMOS technology. The switch fabric of the ASIC chip can handle high line rates, supports multicasing functionality, and permits output groups to be flexibly altered. The ASIC chips may be arranged in an array thereby permitted the switch size to be scaled.

Abstract: A multicast switch for routing incoming cells having a multicast bit pattern and a priority value, arriving at a plurality of input ports, to one of a plurality of output ports, which includes input port controllers and routing modules. Each of the routing modules routes received cells to an associated one of a plurality of groups of output ports and provides a feedback priority value based on a priority value associated with a lowest priority cell passed to the associated group of output ports.