Abstract: Some embodiments of the invention provide a forwarding element (e.g., a switch, a router, etc.) that has one or more data plane, message-processing pipelines with key-value processing circuits. The forwarding element's data plane key-value circuits allow the forwarding element to perform key-value services that would otherwise have to be performed by data compute nodes connected by the network fabric that includes the forwarding element. In some embodiments, the key-value (KV) services of the forwarding element and other similar forwarding elements supplement the key-value services of a distributed set of key-value servers by caching a subset of the most commonly used key-value pairs in the forwarding elements that connect the set of key-value servers with their client applications.

Abstract: An example system includes a transceiver. The transceiver communicates multicast frames to a plurality of client devices in a multicast group. The system further includes a controller. The controller determines that a predetermined time has passed since the transceiver most recently sent a unicast transmission to one of the plurality of client devices. The controller instructs the transceiver to transmit a unicast frame to the one of the plurality of client devices. The controller computes a data rate for the one of the plurality of client devices based on the transmission of the unicast frame to the one of the plurality of client devices.

Abstract: A storage device includes a non-volatile memory including memory blocks, and a storage controller including a history buffer including plural history read level storage areas corresponding to the memory blocks. The storage controller dynamically adjusts a number of the history read level storage areas allocated to one or more of the plurality of memory blocks based on reliabilities of the memory blocks during runtime of the storage device. The storage controller increases a number of history read level storage areas allocated to a first memory block among the memory blocks that has a relatively low reliability with respect to the reliabilities of remaining ones of the memory blocks.

Abstract: Some embodiments provide a method for an ingress packet processing pipeline of a network forwarding integrated circuit (IC). The ingress packet processing pipeline is for receiving packets from a port of the network forwarding IC and processing the packets to assign different packets to different queues of a traffic management unit of the network forwarding IC. The method receives state data from the traffic management unit. The method stores the state data in a stateful table. The method assigns a particular packet to a particular queue based on the state data received from the traffic management unit and stored in the stateful table.

Abstract: Some embodiments provide a method for an ingress packet processing pipeline of a network forwarding integrated circuit (IC). The ingress packet processing pipeline is for receiving packets from a port of the network forwarding IC and processing the packets to assign different packets to different queues of a traffic management unit of the network forwarding IC. The method receives state data from the traffic management unit. The method stores the state data in a stateful table. The method assigns a particular packet to a particular queue based on the state data received from the traffic management unit and stored in the stateful table.

Abstract: Some embodiments of the invention provide a forwarding element that has a data-plane circuit (data plane) that can be configured to implement a DDoS (distributed denial of service) attack detector. The data plane has several stages of configurable data processing circuits, which are typically configured to process data tuples associated with data messages received by the forwarding element in order to forward the data messages within a network. In some embodiments, the configurable data processing circuits of the data plane can also be configured to implement a DDoS attack detector (DDoS detector) in the data plane. In some embodiments, the forwarding element has a control-plane circuit (control plane) that configures the configurable data processing circuits of the data plane, while in other embodiments, a remote controller configures these data processing circuits.

Abstract: A method for verifying data plane programs is provided in some embodiments. Because the behavior of a data plane program (e.g., a program written in the P4 language) is determined in part by the control plane populating match-action tables with specific forwarding rules, in some embodiments, programmers are provided with a way to document assumptions about the control plane using annotations (e.g., in the form of “assertions” or “assumptions” about the state based on the unknown control plane contribution). In some embodiments, annotations are added automatically to verify common properties, including checking that every header read or written is valid, that every expression has a well-defined value, and that all standard metadata is manipulated correctly. The method in some embodiments translates programs from a first language (e.g., P4) to a second language (e.g., Guarded Command Language (GCL)) for verification by a satisfiability modulo theory (SMT) solver.

Abstract: Embodiments described herein describe a network tester that is configured to perform packet modification at an egress pipeline of a programmable packet engine. A packet stream is received at an egress pipeline of an output port of the programmable packet engine, wherein the output port includes a packet modifier. Packets of the packet stream are modified at the packet modifier. The packet stream including modified packets is transmitted through an egress pipeline of the output port.

Abstract: Some embodiments of the invention provide a forwarding element (e.g., a switch, a router, etc.) that has one or more data plane, message-processing pipelines with key-value processing circuits. The forwarding element's data plane key-value circuits allow the forwarding element to perform key-value services that would otherwise have to be performed by data compute nodes connected by the network fabric that includes the forwarding element. In some embodiments, the key-value (KV) services of the forwarding element and other similar forwarding elements supplement the key-value services of a distributed set of key-value servers by caching a subset of the most commonly used key-value pairs in the forwarding elements that connect the set of key-value servers with their client applications.

Abstract: Some embodiments of the invention provide a data-plane forwarding circuit (data plane) that can be configured to identify large data message flows that it processes for forwarding in a network. In this document, large data message flows are referred to as heavy hitter flows. To perform its forwarding operations, the data plane includes several data message processing stages that are configured to process the data tuples associated with the data messages received by the data plane. In some embodiments, parts of the data plane message-processing stages are also configured to implement a heavy hitter detection (HHD) circuit. The operations of the data plane's message processing stages are configured by a control plane of the data plane's forwarding element in some embodiments.

Abstract: An example system includes a transceiver. The transceiver communicates multicast frames to a plurality of client devices in a multicast group. The system further includes a controller. The controller determines that a predetermined time has passed since the transceiver most recently sent a unicast transmission to one of the plurality of client devices. The controller instructs the transceiver to transmit a unicast frame to the one of the plurality of client devices. The controller computes a data rate for the one of the plurality of client devices based on the transmission of the unicast frame to the one of the plurality of client devices.

Abstract: Some embodiments of the invention provide a forwarding element (e.g., a switch, a router, etc.) that has one or more data plane, message-processing pipelines with key-value processing circuits. The forwarding element's data plane key-value circuits allow the forwarding element to perform key-value services that would otherwise have to be performed by data compute nodes connected by the network fabric that includes the forwarding element. In some embodiments, the key-value (KV) services of the forwarding element and other similar forwarding elements supplement the key-value services of a distributed set of key-value servers by caching a subset of the most commonly used key-value pairs in the forwarding elements that connect the set of key-value servers with their client applications.

Abstract: Some embodiments of the invention provide a method for reporting congestion in a network that includes several forwarding elements. In a data plane circuit of one of the forwarding elements, the method detects that a queue in the switching circuit of the data plane circuit is congested, while a particular data message is stored in the queue as it is being processed through the data plane circuit. In the data plane circuit, the method then generates a report regarding the detected queue congestion, and sends this report to a data collector external to the forwarding element. To send the report, the data plane circuit in some embodiments duplicates the particular data message, stores it in the duplicate data message information regarding the detected queue congestion, and sends the duplicate data message to the external data collector.

Abstract: A method for verifying data plane programs is provided in some embodiments. Because the behavior of a data plane program (e.g., a program written in the P4 language) is determined in part by the control plane populating match-action tables with specific forwarding rules, in some embodiments, programmers are provided with a way to document assumptions about the control plane using annotations (e.g., in the form of “assertions” or “assumptions” about the state based on the unknown control plane contribution). In some embodiments, annotations are added automatically to verify common properties, including checking that every header read or written is valid, that every expression has a well-defined value, and that all standard metadata is manipulated correctly. The method in some embodiments translates programs from a first language (e.g., P4) to a second language (e.g., Guarded Command Language (GCL)) for verification by a satisfiability modulo theory (SMT) solver.

Abstract: Some embodiments provide a data-plane forwarding circuit that can be configured to learn about a new message flow and to maintain metadata about the new message flow without first having a control plane first configure the data plane to maintain metadata about the flow. To perform its forwarding operations, the data plane includes several data message processing stages that are configured to process the data tuples associated with the data messages received by the data plane. In some embodiments, parts of the data plane message-processing stages are also configured to operate as a flow-tracking circuit that includes (1) a flow-identifying circuit to identify message flows received by the data plane, and (2) a first set of storages to store metadata about the identified flows.

Abstract: A method for verifying data plane programs is provided in some embodiments. Because the behavior of a data plane program (e.g., a program written in the P4 language) is determined in part by the control plane populating match-action tables with specific forwarding rules, in some embodiments, programmers are provided with a way to document assumptions about the control plane using annotations (e.g., in the form of “assertions” or “assumptions” about the state based on the unknown control plane contribution). In some embodiments, annotations are added automatically to verify common properties, including checking that every header read or written is valid, that every expression has a well-defined value, and that all standard metadata is manipulated correctly. The method in some embodiments translates programs from a first language (e.g., P4) to a second language (e.g., Guarded Command Language (GCL)) for verification by a satisfiability modulo theory (SMT) solver.

Abstract: Some embodiments of the invention provide a data-plane forwarding circuit (data plane) that can be configured to provide protection from a SYN-flood denial of service attack by validating a source of a SYN data messages before allowing future messages to be forwarded to a protected server. To perform its forwarding operations, the data plane includes several data message processing stages that are configured to process the data tuples associated with the data messages received by the data plane. In some embodiments, parts of the data plane message-processing stages are also configured to operate as a connection-validation circuit that includes (1) a SYN-processing circuit to process SYN data messages received by the data plane, and (2) an ACK-processing circuit to process ACK data messages received by the data plane.

Abstract: Some embodiments of the invention provide a data-plane forwarding circuit (data plane) that has a flow-size detection circuit that generates flow-size density distribution for all or some of the data message flows that it processes for forwarding in a network. The flow-size (FS) detection circuit in some embodiments generates statistical values regarding the processed data message flows, and based on these statistical values, it generates a FS density distribution that expresses a number of flows in different flow-size sub-ranges in a range of flow sizes. In some embodiments, the density distribution is a probabilistic density distribution that is based on probabilistic statistical values that the flow-size detection circuit generates for the data message flows that are processed for forwarding within the network.

Abstract: Example implementations relate to determining whether network invariants are violated by flow rules to be implemented by the data plane of a network. In an example, a verification module implemented on a device receives a flow rule transmitted from an SDN controller to a switch, the flow rule relating to an event. The module determines whether the flow rule matches any of a plurality of network invariants cached in the device. If determined that the flow rule matches one of the plurality of network invariants, the verification module determines whether the flow rule violates the matched network invariant. If determined that the flow rule does not match any of the plurality of network invariants, the verification module (1) reports the event associated with the flow rule to a policy management module, (2) receives a new network invariant related to the event from the policy management module, and (3) determines whether the flow rule violates the new network invariant.

Abstract: Some embodiments provide a method for an ingress packet processing pipeline of a network forwarding integrated circuit (IC). The ingress packet processing pipeline is for receiving packets from a port of the network forwarding IC and processing the packets to assign different packets to different queues of a traffic management unit of the network forwarding IC. The method receives state data from the traffic management unit. The method stores the state data in a stateful table. The method assigns a particular packet to a particular queue based on the state data received from the traffic management unit and stored in the stateful table.