Abstract: A system and method is provided for automatically identifying and removing malicious data packets, such as denial-of-service (DoS) packets, in an intermediate network node before the packets can be forwarded to a central processing unit (CPU) in the node. The CPU's processing bandwidth is therefore not consumed identifying and removing the malicious packets from the system memory. As such, processing of the malicious packets is essentially “off-loaded” from the CPU, thereby enabling the CPU to process non-malicious packets in a more efficient manner. Unlike prior implementations, the invention identifies malicious packets having complex encapsulations that can not be identified using traditional techniques, such as ternary content addressable memories (TCAM) or lookup tables.

Abstract: A technique efficiently searches a hash table containing a plurality of “ranges.” In contrast with previous implementations, the technique performs fewer searches to locate one or more ranges stored in the hash table. To that end, the hash table is constructed so each hash-table entry is associated with a different linked list, and each linked-list entry stores, inter alia, “signature” information and at least one pair of values defining a range associated with the signature. The technique modifies the signature based on the results of one or more preliminary range checks. As a result, the signature's associated ranges are more evenly distributed among the hash table's linked lists. Thus, the linked lists are on average shorter in length, thereby enabling faster and more efficient range searches. According to an illustrative embodiment, the technique is applied to flow-based processing implemented in an intermediate network node, such as a router.

Abstract: A method for transferring data between non-contiguous buffers in a memory and an I/O device via a system I/O bus uses a descriptor queue stored in memory. Each descriptor points to a buffer and includes the length of the buffer. The I/O device is provided with the base address of the queue, the length of the queue and a current address which at initialization is the same as the base address. When data is to be transferred a device driver located in the processor sends the number of available descriptors (DescrEnq) to the I/O device which accesses the descriptors individually or in burst mode to gain access to the data buffers identified by the descriptors.

Abstract: A method for transferring data between non-contiguous buffers in a memory and an I/O device via a system I/O bus uses a descriptor queue stored in memory. Each descriptor points to a buffer and includes the length of the buffer. The I/O device is provided with the base address of the queue, the length of the queue and a current address which at initialization is the same as the base address. When data is to be transferred a device driver located in the processor sends the number of available descriptors (DescrEnq) to the I/O device which accesses the descriptors individually or in burst mode to gain access to the data buffers identified by the descriptors.

Abstract: A method for transferring data between non-contiguous buffers in a memory and an I/O device via a system I/O bus uses a descriptor queue stored in memory. Each descriptor points to a buffer and includes the length of the buffer. The I/O device is provided with the base address of the queue, the length of the queue and a current address which at initialization is the same as the base address. When data is to be transferred a device driver located in the processor sends the number of available descriptors (DescrEnq) to the I/O device which accesses the descriptors individually or in burst mode to gain access to the data buffers identified by the descriptors.

Abstract: A method for transferring data between non-contiguous buffers in a memory and an I/O device via a system I/O bus uses a descriptor queue stored in memory. Each descriptor points to a buffer and includes the length of the buffer. The I/O device is provided with the base address of the queue, the length of the queue and a current address which at initialization is the same as the base address. When data is to be transferred a device driver located in the processor sends the number of available descriptors (DescrEnq) to the I/O device which accesses the descriptors individually or in burst mode to gain access to the data buffers identified by the descriptors.

Abstract: A method for transferring data between non-contiguous buffers in a memory and an I/O device via a system I/O bus uses a descriptor queue stored in memory. Each descriptor points to a buffer and includes the length of the buffer. The I/O device is provided with the base address of the queue, the length of the queue and a current address which at initialization is the same as the base address. When data is to be transferred a device driver located in the processor sends the number of available descriptors (DescrEnq) to the I/O device which accesses the descriptors individually or in burst mode to gain access to the data buffers identified by the descriptors.