Abstract: A flow based reply cache of a storage system is illustratively organized into one or more microcaches, each having a plurality of reply cache entries. Each microcache is maintained by a protocol server executing on the storage system and is allocated on a per client basis. To that end, each client is identified by a client connection or logical “data flow” and is allocated its own microcache and associated entries, as needed. As a result, each microcache of the reply cache may be used to identify a logical stream of client requests associated with a data flow, as well as to isolate that client stream from other client streams and associated data flows used to deliver other requests served by the system. The use of microcaches thus provides a level of granularity that enables each client to have its own pool of reply cache entries that is not shared with other clients, thereby obviating starvation of entries allocated to the client in the reply cache.

Abstract: A system and method determines when the entries of a reply cache, organized into microcaches each of which is allocated to a client connection, may be retired or released, thereby freeing up memory structures. A plurality of connection statistics are defined and tracked for each microcache and for the entries of the microcache. The connection statistics indicate the value of the microcache and its entries to the client. The connection statistics include a measure of the time since the last idempotent or non-idempotent request (TOLR) was received, and a count of the number of idempotent requests that have been received since the last non-idempotent request (RISLR). A microcache with a TOLR time and a RISLR count that exceed respective thresholds may be expired and removed from the reply cache.

Abstract: One embodiment of the present invention provides a system that classifies elements in a structured data stream. Upon receiving an element from the structured data stream, the system applies a hash function to the element to generate a single hash value. Next, the system divides the single hash value into multiple sections, and uses the multiple sections as inputs to a Bloom filter to determine if a node for the element exists in an associated lookup structure. If so, the system looks up the node for the element in the associated lookup structure. Note that using the Bloom filter in this way prevents unnecessary lookups. Furthermore, using multiple sections of a single hash value as inputs to the Bloom filter eliminates the need to compute multiple hash values.

Abstract: A flow manager may receive prioritized packet flow rules from one or more network services where each rule may include a packet filter and prioritized actions. Each action of a packet flow rule may be either terminating or non-terminating. A flow manager may generate a unified rule set according to the received packet flow rules and may additionally validate the unified rule set to identity errors. When validating the unified rule set, a flow manager may compare the unified rule set against one or more defined policies. Alternatively, a flow manager may apply the unified rule set to either captured or manually specified simulated network packets. A flow manager may also identity extraneous rules or actions. Further, a flow manager may present the unified rule set for manual verification and may receive input identifying errors and specifying modification to correct the errors.

Abstract: A datacenter system including a plurality of nodes configured to send and receive a service request, a service table on the plurality of nodes configured to store route information extracted from a signaling mechanism, and a forwarding engine configured to route the service request to at least one of the plurality of nodes using route information from the service table.

Abstract: A flow manager may receive packet flow rules from one or more network services and may generate a unified rule set according to the received packet flow rules. A flow manager may additionally split the unified rule set into subsets for enforcement by one or more flow enforcement devices and may install the rule subsets onto the flow enforcement devices. When splitting the unified rule set into subsets, a flow manager may analyze a network topology connecting the flow enforcement devices. A flow manager may also receive additional packet flow rules, integrate them into the unified rule set, update the rule subsets according to the additional rules, and install the updated subsets onto the flow enforcement devices.

Abstract: A flow manager may receive prioritized packet flow rules from multiple prioritized network services where each flow rule may comprise a packet filter and a prioritized action list. The priority for the flow rules from each network service may be expressed as either longest prefix or ordered precedence. The flow manager may generate a unified rule set according to the received packet flow rules by identifying conflict between pairs of rules and resolving the identified conflicts according the priority relationship two rules of each pair. When resolving conflicts between rules, the flow manager may append the action list of one rule to the action list of another rule, and may also create a new rule by combining the packet filters and actions lists of the conflicting rules.

Abstract: One embodiment of the present invention provides a system that resolves conflicts between network service rules for network data traffic in a system where rule patterns with longer prefixes match before rule patterns with shorter prefixes. The system operates by receiving a set of network service rules for network data traffic from multiple network services, wherein network service rules from different network services can possibly conflict. Each of these network service rules specifies: a filter that defines a prefix for a set of packets in the packet flow, and an action list that specifies one or more actions to be applied to the set of packets. Next, the system identifies a conflict between a higher priority rule and a lower priority rule in the set of network service rules. The system resolves this conflict by prepending an action list of the higher priority rule to an action list of a rule with a filter that defines a longer prefix.