Abstract: In one embodiment, an apparatus includes a switch core that defines a single logical entity and has a multi-stage switch fabric physically distributed across a plurality of chassis. The multi-stage switch fabric has a plurality of ingress ports and a plurality of egress ports. The switch core is configured to be coupled to a plurality of peripheral processing devices via the plurality of ingress ports and the plurality of egress ports. The switch core is also configured to provide non-blocking connectivity at line rate between a first peripheral processing device disposed with a first chassis and a second peripheral processing device disposed within a second chassis.

Abstract: A multicast-capable firewall allows firewall security policies to be applied to multicast traffic. The multicast-capable firewall may be integrated within a routing device, thus allowing a single device to provide both routing functionality, including multicast support, as well as firewall services. The routing device provides a user interface by which a user specifies one or more zones to be recognized by the integrated firewall when applying stateful firewall services to multicast packets. The user interface supports a syntax that allows the user to define subsets of the plurality of interfaces associated with the zones, and define a single multicast policy to be applied to multicast sessions associated with a multicast group. The multicast policy identifies common services to be applied pre-replication, and exceptions specifying additional services to be applied post-replication to copies of the multicast packets for the one or more zones.

Abstract: A method includes installing an interface card having a first module of a switch fabric and a second module of the switch fabric, and an interface card having a third module of the switch fabric in a first chassis, within a first time period. The switch fabric is in a first configuration and is operable as a three-stage switch fabric after the first time period and before a second time period. The interface card having the third module is removed from the first chassis within the second time period. An interface card having a fourth module of the switch fabric and a fifth module of the switch fabric is installed in the first chassis within the second time period. The switch fabric is in a transitional configuration and is operable as a three-stage switch fabric after the second time period but before the third time period. The interface card having the third module is installed in a second chassis and the first chassis is operatively coupled with the second chassis within the third time period.

Abstract: A network device may receive a packet including control tags in a header portion of the packet and may extract candidate tags from the control tags in the header portion of the packet. The network device may compress, using a first lookup table, the candidate tags to obtain keys corresponding to the candidate tags, where each of the keys is represented in a compressed format relative to the corresponding candidate tags. The network device may further determine a final key based on the first keys and determine a priority class for the packet based on a lookup operation of the final key into a second lookup table. The network device may further write the packet, or a reference to the packet, to a selected priority queue, of a number of priority queues, where the priority queue is selected based on the determined priority class.

Abstract: A data read/write system includes a system clock, a single port memory, a cache memory that is separate from the single port memory, and a controller coupled to an instruction pipeline. The controller receives, via the instruction pipeline, first data to write to an address of the single port memory, and further receives, via the instruction pipeline, a request to read second data from the single port memory. The controller stores the first data in the cache memory, and retrieves the second data from either the cache memory or the single port memory during one or more first clock cycles of the system clock. The controller copies the first data from the cache memory and stores the first data at the address in the single port memory during a second clock cycle of the system clock that is different than the one or more first clock cycles.

Abstract: In some embodiments, a non-transitory processor-readable medium stores code representing instructions to be executed by a processor. The code causes the processor to receive, from a source peripheral processing device, a portion of a data packet having a destination address associated with a destination peripheral processing device. The code causes the processor to identify, based on the destination address, a service to be performed on the portion of the data packet. The code causes the processor to select, based on the service, an identifier of a service module associated with the service. The code further causes the processor to send the portion of the data packet to the service module via a distributed switch fabric such that the service module performs the service on the portion of the data packet and sends the portion of the data packet to the destination peripheral processing device via the distributed switch fabric.

Abstract: In some embodiments, a non-transitory processor-readable medium stores code representing instructions to be executed by a processor. The code causes the processor to receive, at an edge device, a first data unit having a characteristic. The code causes the processor to identify, at a first time, an identifier of a service module associated with the characteristic in response to each entry from a set of entries within a flow table not being associated with the characteristic. The code causes the processor to define an entry in the flow table associated with the characteristic and the identifier of the service module. The code causes the processor to send the first data unit to the service module. The code causes the processor to receive, at the edge device, a second data unit having the characteristic, and send the second data unit to the service module based on the entry.

Abstract: In general, the invention is directed to techniques for reducing deadlocks that may arise when performing fabric replication. For example, as described herein, a network device includes packet replicators that each comprises a plurality of resource partitions. A replication data structure for a packet received by the network device includes packet replicator nodes that are arranged hierarchically to occupy one or more levels of the replication data structure. Each of the resource partitions in each of the plurality of packet replicators is associated with a different level of the replication data structure. The packet replicators replicate the packet according to the replication data structure, and each of the packet replicators handles the packet using the one of the resource partitions of the packet replicator that is associated with the level of the replication data structure occupied by the node that corresponds to that particular packet replicator.

Abstract: In one embodiment, a processor-readable medium can store code representing instructions that when executed by a processor cause the processor to receive a value representing a congestion level of a receive queue and a value representing a state of a transmit queue. At least a portion of the transmit queue can be defined by a plurality of packets addressed to the receive queue. A rate value for the transmit queue can be defined based on the value representing the congestion level of the receive queue and the value representing the state of the transmit queue. The processor-readable medium can store code representing instructions that when executed by the processor cause the processor to define a suspension time value for the transmit queue based on the value representing the congestion level of the receive queue and the value representing the state of the transmit queue.

Abstract: A network device includes a receiver component that generates flow control information. The network device also includes a transmitter component that receives a packet for forwarding to the receiver component, receives flow control data for the packet from the receiver component, and provides the packet and the flow control data for the packet to a fabric component. The fabric component performs a congestion management operation for the packet, and forwards the packet to the receiver component based on the flow control data and results of the congestion management operation.

Abstract: In one embodiment, an apparatus can include a policy vector module configured to retrieve a compressed policy vector based on a portion of a data packet received at a multi-stage switch. The apparatus can also include a decompression module configured to receive the compressed policy vector and configured to define a decompressed policy vector based on the compressed policy vector. The decompressed policy vector can define a combination of bit values associated with a policy.

Abstract: An example network device includes a control plane and a filter lookup module that includes a Bloom filter that supports parallel lookup of a maximum number of different prefix lengths. The filter lookup module accesses the Bloom filter to determine a longest length prefix that matches an entry in a set of prefixes. The control plane receives prefix lengths that include more than the maximum number of different prefix lengths supported by the Bloom filter, wherein the set of prefix lengths is associated with one application, generates, based on the received set of prefix lengths, two or more groups of different prefix lengths, wherein each of the two or more groups of different prefix lengths includes no more than the maximum number of different prefix lengths, and programs the filter lookup module with the two or more groups of different prefix lengths associated with the one application.

Abstract: Methods and systems consistent with the present invention provide efficient packet replication in a router in order to multicast a stream of data. Packets are replicated and processed in a multithreaded environment. Embodiments consistent with the present invention implement a two-stage process for packet replication. The first stage thread will recirculate the packet to multiple second-stage threads. These second-stage threads will then create one or more outgoing copies of the packet. In this way, the copies are handled by multiple threads running in parallel.

Abstract: Data units received by a network device may be classified into traffic flow classes in which the determined traffic flow class for a data unit may be dynamically refined as the data unit is processed by the network device. A dispatch component of the network device may receive data units associated with traffic flow classes. Parallel processing engines of the network device may receive the data units from the dispatch component and may generate, for a least one of the data units, a plurality of dynamically refined indications of the traffic flow class to which the data unit belongs. Additionally, an ordering component of the network device may include a plurality of re-order queues, where the at least one data unit successively progresses through at least two of the re-order queues in an order defined by the plurality of dynamically refined indications of the traffic flow class.

Abstract: A data read/write system receives a key associated with a data read request. The data read/write system hashes the key to obtain a first hash value and hashes the key to obtain a second hash value, where the second hash value is different than the first hash value. The data read/write system obtains a pointer from a pointer array using the first and second hash values, and uses one or more bits of the pointer and the first hash value to retrieve data from a data look-up array.

Abstract: In one embodiment, edge devices can be configured to be coupled to a multi-stage switch fabric and peripheral processing devices. The edge devices and the multi-stage switch fabric can collectively define a single logical entity. A first edge device from the edge devices can be configured to be coupled to a first peripheral processing device from the peripheral processing devices. The second edge device from the edge devices can be configured to be coupled to a second peripheral processing device from the peripheral processing devices. The first edge device can be configured such that virtual resources including a first virtual resource can be defined at the first peripheral processing device. A network management module coupled to the edge devices and configured to provision the virtual resources such that the first virtual resource can be migrated from the first peripheral processing device to the second peripheral processing device.

Abstract: A network device includes an interface (105), a TCP/IP protocol fast processing path (115), and a TCP/IP protocol slow processing path (110). The interface (105) receives a packet and parses the packets to determine a characteristic of the packet. The TCP/IP protocol fast processing path (115) processes the packet if the characteristic of the packet includes a first characteristic. The TCP/IP protocol slow processing path (110) processes the packet if the characteristic of the packet includes a second characteristic.

Abstract: A network router includes a plurality of interfaces configured to send and receive packets, and a routing component comprising: (i) a routing engine that includes a control unit that executes a routing protocol to maintain routing information specifying routes through a network, and (ii) a forwarding plane configured by the routing engine to select next hops for the packets in accordance with the routing information. The forwarding plane comprises a switch fabric to forward the packets to the interfaces based on the selected next hops. The network router also includes a security plane configured to apply security functions to the packets. The security plane is integrated within the network router to share a streamlined forwarding plane of the routing component.

Abstract: In one embodiment, an apparatus can include a first edge device that can have a packet processing module. The first edge device can be configured to receive a packet. The packet processing module of the first edge device can be configured to produce cells based on the packet. A second edge device can have a packet processing module configured to reassemble the packet based on the cells. A multi-stage switch fabric can be coupled to the first edge device and the second edge device. The multi-stage switch fabric can define a single logical entity. The multi-stage switch fabric can have switch modules. Each switch module from the switch modules can have a shared memory device. The multi-stage switch fabric can be configured to switch the cells so that the cells are sent to the second edge device.

Abstract: In one embodiment, an apparatus includes a switch core that has a multi-stage switch fabric. The multi-stage switch fabric has a set of ingress ports and a set of egress ports. The switch core can be configured to be coupled to a set of edge devices via the set of ingress ports and the set of egress ports. The switch core can be configured to receive a packet from an ingress port from the set of ingress ports. The switch core can be configured to send a set of cells associated with the packet from the ingress port to an egress port from the set of egress ports without a store-and-forward delay associated with a zero-load latency for the switch core.