Abstract: Techniques are provided for managing a routing table in a distributed network switch. The distributed network switch is divided into logical switch partitions, or logical networks, that may share a routing table. The shared routing table is configured with counters and thresholds to control utilization of the routing table on a per-logical network basis. When counters exceed certain threshold, the routing table is modified to reduce routing entries within the routing table or pause insertion of new routing entries.

Abstract: Methods, computer program products, and systems to assist in distribution of packets between a plurality of switch elements in a distributed switch, by monitoring an attribute of each of the plurality of switch elements including a first switch element and a first surrogate switch element, the first surrogate switch element in a first level of a hierarchy and configured using a default hierarchy configuration, the default hierarchy configuration forwarding a data frame to at least one of: a destination switch element of the data frame, and a second surrogate switch element, the second surrogate switch element in a second hierarchy level; computing a score, based on the monitored attribute, for each of the switch elements; and upon determining the score of the first switch element is greater than the score of the first surrogate switch element, designating the first switch element as the first surrogate switch element.

Abstract: A firmware model is provided for a shared port membership table that is partitioned for different needs of a distributed network switch, such as broadcast groups, multicast groups, ACL rules, and other port membership groupings. The shared port membership table enables a control point to set the size of each of the types of port membership information based on their usage or expected usage. By shrinking one partition, the control point is able to use the port group entries for a different partition of port group information.

Abstract: Techniques are provided for multicast miss notification for a distributed network switch. In one embodiment, a bridge element in the distributed network switch receives a frame destined for a multicast group on a network. If a local multicast forwarding table of the bridge element does not include any forwarding entry for the multicast group, a forwarding entry is selected from the local multicast forwarding table as a candidate for being replaced. An indication of the candidate is sent to a management controller in the distributed network switch.

Abstract: The different switch modules making up a distributed virtual switch may route configuration commands for hardware resources to different modules within the distributed switch using a distribution and routing layer. At least one of the switch modules maintains a routing table that defines which switch modules are responsible for which hardware resources. The switch module uses the routing tables to forward the commands on the distribution and routing layer to the responsible switch module which then ensures that the relevant hardware resources are configured.

Abstract: The different switch modules making up a distributed virtual switch may route configuration commands for hardware resources to different modules within the distributed switch using a distribution and routing layer. At least one of the switch modules maintains a routing table that defines which switch modules are responsible for which hardware resources. The switch module uses the routing tables to forward the commands on the distribution and routing layer to the responsible switch module which then ensures that the relevant hardware resources are configured.

Abstract: Techniques are provided for packet routing in a distributed network switch. The distributed network switch includes multiple switch modules operatively connected to one another, and each switch module includes multiple bridge elements and a management controller. In one embodiment, a shared interface routing (SIR) framework is provided that includes an analysis and bifurcation layer, at least one packet interface, and an analysis assist layer. A packet is received over a first logical network and via a physical port, the packet being destined for at least a first application executing on the management controller. The analysis assist layer analyzes the packet to determine a reason code to assign to the packet. The analysis and bifurcation layer then analyzes the packet based at least in part on the reason code.

Abstract: Techniques are provided for packet routing in a distributed network switch. The distributed network switch includes multiple switch modules operatively connected to one another, and each switch module includes multiple bridge elements and a management controller. In one embodiment, a shared interface routing (SIR) framework is provided that includes an analysis and bifurcation layer, at least one packet interface, and an analysis assist layer. A packet is received over a first logical network and via a physical port, the packet being destined for at least a first application executing on the management controller. The analysis assist layer analyzes the packet to determine a reason code to assign to the packet. The analysis and bifurcation layer then analyzes the packet based at least in part on the reason code.

Abstract: Techniques are provided for managing a routing table in a distributed network switch. The distributed network switch is divided into logical switch partitions, or logical networks, that may share a routing table. The shared routing table is configured with counters and thresholds to control utilization of the routing table on a per-logical network basis. When counters exceed certain threshold, the routing table is modified to reduce routing entries within the routing table or pause insertion of new routing entries.

Abstract: Method to assist in distribution of packets between a plurality of switch elements in a distributed switch, by monitoring an attribute of each of the plurality of switch elements including a first switch element and a first surrogate switch element, the first surrogate switch element in a first level of a hierarchy and configured using a default hierarchy configuration. The default hierarchy configuration forwards a data frame to at least one of: a destination switch element of the data frame, and a second surrogate switch element. The second surrogate switch element is in a second hierarchy level. A score is computed based on the monitored attribute for each of the switch elements. Upon determining the score of the first switch element is greater than the score of the first surrogate switch element, the first switch element is designated as the first surrogate switch element.

Abstract: Method, computer program product, and system to assist in distribution of packets between a plurality of switch elements in a distributed switch, by monitoring an attribute of each of the plurality of switch elements including a first switch element and a first surrogate switch element, the first surrogate switch element in a first level of a hierarchy and configured using a default hierarchy configuration, the default hierarchy configuration forwarding a data frame to at least one of: a destination switch element of the data frame, and a second surrogate switch element, the second surrogate switch element in a second hierarchy level; computing a score, based on the monitored attribute, for each of the switch elements; and upon determining the score of the first switch element is greater than the score of the first surrogate switch element, designating the first switch element as the first surrogate switch element.

Abstract: Techniques are provided for retrieving entries from a routing table or a forwarding database in a distributed network switch. The forwarding database includes match and mask registers used to compare routing entries and return matching routing entries to a requesting management controller. The forwarding database uses a separate timeout value associated with the forwarding database to avoid timeout errors for general register operations, and allows for an asynchronous dump operation of routing entries.

Abstract: Techniques are disclosed for notifying network control software of new and moved source MAC addresses. In one embodiment, a switch may redirect a packet sent by a new or migrated virtual machine to the network control software as a notification. The switch does not forward the packet, thereby protecting against denial of service attacks. The switch further adds to a forwarding database a temporary entry which includes a “No_Redirect” flag for a new source MAC address, or updates an existing entry for a source MAC address that hits in the forwarding database by setting the “No_Redirect” flag. The “No_Redirect” flag indicates whether a notification has already been sent to the network control software for this source MAC address. The switch may periodically retry the notification to the network control software, until the network control software validates the source MAC address, depending on whether the “No_Redirect” is set.

Abstract: Techniques are disclosed for notifying network control software of new and moved source MAC addresses. In one embodiment, a switch may redirect a packet sent by a new or migrated virtual machine to the network control software as a notification. The switch does not forward the packet, thereby protecting against denial of service attacks. The switch further adds to a forwarding database a temporary entry which includes a “No_Redirect” flag for a new source MAC address, or updates an existing entry for a source MAC address that hits in the forwarding database by setting the “No_Redirect” flag. The “No_Redirect” flag indicates whether a notification has already been sent to the network control software for this source MAC address. The switch may periodically retry the notification to the network control software, until the network control software validates the source MAC address, depending on whether the “No_Redirect” is set.

Abstract: Techniques are disclosed for notifying network control software of new and moved source MAC addresses. In one embodiment, a switch detects packets sent by a new or migrated virtual machine, and sends a copy of a detected packet to the network control software as a notification. The switch further learns the source MAC address, thereby permitting the entry to be used for normal forwarding prior to validation of the entry and the VM associated therewith by the network control software. Until the network control software has validated the VM, the switch may periodically retry the notification to the network control software. “No_Redirect” and “Not_Validated” flags may be used to indicate whether a notification has already been attempted and thus no retry is necessary, and that the VM associated with the VM has not yet been validated, respectively.

Abstract: Techniques are provided for retrieving entries from a routing table or a forwarding database in a distributed network switch. The forwarding database includes match and mask registers used to compare routing entries and return matching routing entries to a requesting management controller. The forwarding database uses a separate timeout value associated with the forwarding database to avoid timeout errors for general register operations, and allows for an asynchronous dump operation of routing entries.

Abstract: Techniques are disclosed for notifying network control software of new and moved source MAC addresses. In one embodiment, a switch may redirect a packet sent by a new or migrated virtual machine to the network control software as a notification. The switch does not forward the packet, thereby protecting against denial of service attacks. The switch further adds to a forwarding database a temporary entry which includes a “No_Redirect” flag for a new source MAC address, or updates an existing entry for a source MAC address that hits in the forwarding database by setting the “No_Redirect” flag. The “No_Redirect” flag indicates whether a notification has already been sent to the network control software for this source MAC address. The switch may periodically retry the notification to the network control software, until the network control software validates the source MAC address, depending on whether the “No_Redirect” is set.

Abstract: Techniques are disclosed for notifying network control software of new and moved source MAC addresses. In one embodiment, a switch may redirect a packet sent by a new or migrated virtual machine to the network control software as a notification. The switch does not forward the packet, thereby protecting against denial of service attacks. The switch further adds to a forwarding database a temporary entry which includes a “No_Redirect” flag for a new source MAC address, or updates an existing entry for a source MAC address that hits in the forwarding database by setting the “No_Redirect” flag. The “No_Redirect” flag indicates whether a notification has already been sent to the network control software for this source MAC address. The switch may periodically retry the notification to the network control software, until the network control software validates the source MAC address, depending on whether the “No_Redirect” is set.

Abstract: Techniques are disclosed for notifying network control software of new and moved source MAC addresses. In one embodiment, a switch detects packets sent by a new or migrated virtual machine, and sends a copy of a detected packet to the network control software as a notification. The switch further learns the source MAC address, thereby permitting the entry to be used for normal forwarding prior to validation of the entry and the VM associated therewith by the network control software. Until the network control software has validated the VM, the switch may periodically retry the notification to the network control software. “No_Redirect” and “Not_Validated” flags may be used to indicate whether a notification has already been attempted and thus no retry is necessary, and that the VM associated with the VM has not yet been validated, respectively.

Abstract: Techniques are provided for packet routing in a distributed network switch. The distributed network switch includes multiple switch modules operatively connected to one another, and each switch module includes multiple bridge elements and a management controller. In one embodiment, a shared interface routing (SIR) framework is provided that includes an analysis and bifurcation layer and at least one packet interface. A packet is received over a first logical network and via a physical port, the packet being destined for at least a first application executing on the management controller. The analysis and bifurcation layer analyzes the packet and sends the packet to the packet interface, which then routes the packet to the first application.