Abstract: Embodiments of the invention relate to providing virtual network domain movement operations for overlay networks. One embodiment includes a method that includes determining one or more overlay network attributes (ONAs) for a plurality of virtual networks. The one or more ONAs are associated with the virtual networks. The one or more ONAs are managed as one or more portable entities by one or more of creating ONAs, deleting ONAs, moving ONAs, combining ONAs and dividing ONAs. A movement operation is performed on the one or more virtual networks among one or more servers of one or more overlay networks based on the management of the one or more ONAs.

Abstract: Reassembly of member cells into a packet comprises receiving an incoming member cell of a packet from a switching fabric wherein each member cell comprises a segment of the packet and a header, generating a reassembly key using selected information from the incoming member cell header wherein the selected information is the same for all member cells of the packet, checking a reassembly table in a content addressable memory to find an entry that includes a logic key matching the reassembly key, and using a content index in the found entry and a sequence number of the incoming member cell within the packet, to determine a location offset in a reassembly buffer area for storing the incoming member cell at said location offset in the reassembly buffer area for the packet for reassembly.

Abstract: In one embodiment, a switch includes a processor and logic integrated with and/or executable by the processor to receive details about which link aggregation (LAG) information about a first peer switch will be exchanged with the switch, send to the first peer switch, prior to receiving the LAG information about the first peer switch, details about which LAG information about the switch will be exchanged with the first peer switch, receive the LAG information about the first peer switch, store the LAG information about the first peer switch, and use the LAG information about the first peer switch and the LAG information about the switch to determine load balancing across one or more connections between the switch and the first peer switch.

Abstract: A clustered network may include a plurality of switch boxes where a master switch box may communicate and control hardware devices in remote switch boxes. The switch boxes in the network may each include a multiplexer, for example, a field programmable array (FPGA) that may process message requests related to hardware devices of a switch box. If the hardware device is in a remote switch box, then the FPGA of the master switch box may process the status data from the remote switch box so that a local processor in the master switch box can read the status data.

Abstract: A first cluster includes first switching devices that are compatible with a software-defined networking (SDN) protocol. A second cluster includes second switching devices within or partially within overlapping the first cluster. Each second switching device is compatible with a protocol for an open systems interconnection (OSI) model layer. The first switching devices include one or more border switching devices located at a boundary between the first cluster and the second cluster. Each border switching device is also compatible with the protocol for the OSI model layer. The first switching devices effect first multipathing through the network except through the second cluster, and the second switching devices effect second multipathing just through the second cluster of the network. As such, the first switching devices and the second switching devices together effect end-to-end multipathing through both the first cluster and the second cluster of the network.

Abstract: In one embodiment, a system includes a switch controller configured to communicate with a plurality of network devices in a network. The switch controller includes a processor and logic integrated with and/or executable by the processor. The logic is configured to determine a throughput associated with a workload in the network and select an optimum location for the workload in the network based on the throughput associated with the workload. In another embodiment, a computer program product includes a computer readable storage medium having program code embodied therewith. The embodied program code is readable/executable by a processor to cause the processor to determine a throughput associated a workload in a network. The embodied program code is also readable/executable by the processor to cause the processor to select an optimum location for the workload in the network based on the throughput associated with the workload.

Abstract: A tool for supporting load distribution across one or more logical switch routers in a distributed system. The tool includes a first software module configurable to launch and monitor one or more application processes within the one or more logical switch routers in the distributed system. The tool includes a second software module configurable to manage a plurality of system information for the one or more logical switch routers in the distributed system. The tool includes a third software module configurable to control and manage a plurality of system resources in the distributed system. The tool includes a fourth software module configurable to control and manage a plurality of physical ports and a plurality of virtual ports in the distributed system. The tool includes a fifth software module configurable to manage a plurality of load distribution policies for the one or more logical switch routers in the distributed system.

Abstract: According to one embodiment, a system includes at least one switching distributed line card (DLC) configured to apply Access Control Lists (ACLs) on each switching interface of the at least one switching DLC to direct certain received packets to at least one appliance DLC to have deep packet inspection services performed on the certain received packets, and at least one central switch fabric coupler (SFC) in communication with the at least one switching DLC, where the at least one appliance DLC and the at least one switching DLC are connected to the at least one central SFC. Other systems, methods and computer program products for providing scalable virtual appliance cloud (SVAC) services are described in more embodiments.

Abstract: In one embodiment, a method includes obtaining a list of registered applications, each application indicated by the list having been provided permission and authenticated to operate within a network. The list includes: an identifier, one or more first hash values obtained individually for each of the registered applications, and a plurality of second hash values obtained individually for each dependent file associated with each of the registered applications. The method also includes detecting unauthorized alterations of and injections into the dependent files associated with each of the registered applications based on the list, and performing an action in response to detecting unauthorized alterations of and injections into the dependent files. Other systems, methods, and computer program products are described in accordance with more embodiments.

Abstract: Congestion management for data traffic in a virtual domain identifies a congestion source and sends a message to the source to adjust data traffic rates. The source may be a virtual machine hosted by a physical server with one or more virtual servers incorporated. A congestion manager may identify the source and send the message to the source without affecting other data sources hosted by the physical server or the virtual servers. In some embodiments, information about the congestion source may be encapsulated in a packet payload readable only by the congestion source so only the congestion source receives the instruction to adjust the transmission rate.

Abstract: In one embodiment, a method includes receiving network traffic, determining whether packets have an overlay header, terminating a tunnel and de-encapsulating inner packets of packets having an overlay header, performing services on the inner packets in response to a determination that services are to be performed on the inner packets, originating a tunnel, encapsulating a first packet of the serviced inner packets with an overlay header, and switching the encapsulated serviced inner packets to a destination address in a virtual network in response to determining that the first packet is to be switched to the destination address in the virtual network, and switching a second packet of the serviced inner packets to a destination address in a non-virtual network without encapsulating the serviced inner packets with the overlay header in response to a determination that the second packet is to be switched to the destination address in the non-virtual network.

Abstract: Methods and systems presented herein provide for self-routing multicast. In one embodiment, a method includes receiving, using a switch controller, a multicast data stream join request from a source in a network, and creating, using the switch controller, a multipath identifier (ID) for a multicast data stream. Moreover, the method includes creating, using the switch controller, path identifiers (IDs) for intermediate switches in the network based on a local network topology database. Each path ID is associated with an output port bitmap. The method also includes transmitting, using the switch controller, the multipath ID and a path ID to a source of the multicast data stream, the path ID corresponding to the source of the multicast join request. Also, the multipath ID and the path ID are configured to allow the source of the multicast data stream to determine an output port mapping for a packet.

Abstract: Embodiments relate to managing data flows at a virtual forwarding element. A method for managing data flows at a virtual forwarding element executing in a host that has a network interface card (NIC) is provided. The method receives, from a virtual machine executing in the host, a packet that belongs to a data flow originating from the virtual machine. The method identifies a network identifier for the data flow based on a mapping between a plurality of virtual machines executing in the host and a plurality of network identifiers. The mapping is provided by a network controller that configures the virtual forwarding element. The method encapsulates the packet with the network identifier and a tunnel header that includes network addresses of the host. The method sends the encapsulated packet to the NIC. The NIC transmits the encapsulated packet out of the host and towards a destination of the packet.

Abstract: In one embodiment, a system includes a hardware processor and logic integrated with and/or executable by the processor, the logic being adapted to receive a traffic flow having a plurality of packets, classify the traffic flow into a traffic class based on a characteristic of the traffic flow, the traffic class being selected from a plurality of traffic classes, store an identifier of the selected traffic class to one or more of the packets, and transmit the traffic flow according to its destination based on a priority of its selected traffic class. In more embodiments, additional systems, methods, and computer program products for prioritizing traffic flow handling are described.

Abstract: In one embodiment, a system includes a hardware processor and logic integrated with and/or executable by the processor. The logic is configured to classify a traffic flow into a traffic class based on at least one criteria related to the traffic flow and request that a credit manager remap flow credits corresponding to a first traffic class to flow credits corresponding to a second traffic class. In another embodiment, a method for providing credit-based flow control includes classifying a traffic flow into a traffic class based on at least one criteria related to the traffic flow, the traffic class being selected from a plurality of traffic classes. The method also includes storing an identifier indicating the traffic class of packets of the traffic flow according to a virtual local area network (VLAN) identifier in a three bit VLAN tag portion of a header of one or more of the packets.

Abstract: In one embodiment, a computer program product includes a computer readable storage medium having program instructions embodied therewith. The embodied program instructions are readable/executable by a processor to receive, by the processor, a packet via a network fabric, the network fabric having a plurality of interconnected fabric switches. The embodied program instructions are also readable/executable by the processor to determine, by the processor, a path through the network fabric by consulting a source-routing table. Moreover, the embodied program instructions are readable/executable by the processor to store, by the processor, source-routing information to a packet header for the packet, the source-routing information including the path. In addition, the embodied program instructions are readable/executable by the processor to send, by the processor, the packet according to an indication in the source-routing information.

Abstract: According to one embodiment, a method includes performing functionality of a management plane and a control plane for a switch system using a processor of an external host coupled to the switch system via one or more peripheral component interconnect express (PCIe) ports. The method also includes providing a direct memory access (DMA) facility between the external host and switching logic of the switch system. The switch system includes a PCIe interface block coupled to PCIe ports configured to couple to external PCIe devices. Also, the PCIe interface block includes logic configured to provide DMA for each PCIe lane thereof. The switch system also includes multiple switched Ethernet ports configured to couple to one or more external Ethernet devices and switching logic configured to switch between the multiple switched Ethernet ports and the PCIe ports using DMA and a local processor coupled to the PCIe interface block.

Abstract: Management and provisioning of networking traffic may be provided by bundling virtual channels into a group. A global policy may be applied to the bundle so that virtual ports providing services to a client may be managed by referring to the global policy of the bundle. The channels comprising the bundle may span multiple physical ports and in some cases, multiple physical switches. Thus, policy management may be avoided at the port level and instead, be handled as groups of channels implementing a client service.

Abstract: A first cluster includes first switching devices that are compatible with a software-defined networking (SDN) protocol. A second cluster includes second switching devices within or partially overlapping the first cluster. Each second switching device is compatible with a protocol for an open systems interconnection (OSI) model layer. The first switching devices include one or more border switching devices located at a boundary between the first cluster and the second cluster. Each border switching device is also compatible with the protocol for the OSI model layer. The first switching devices effect first multipathing through the network except through the second cluster, and the second switching devices effect second multipathing just through the second cluster of the network. As such, the first switching devices and the second switching devices together effect end-to-end multipathing through both the first cluster and the second cluster of the network.

Abstract: According to one embodiment, a system includes a processor and logic integrated with and/or executable by the processor, the logic being configured to identify a security issue affecting a first peer in one or more secure transmission control protocol/user datagram protocol (TCR/UDP) sessions, inform a second peer about the security issue using the first peer of the one or more TCP/UDP sessions, and perform at least one action in response to identifying and/or being informed about the security issue. In another embodiment, a method for providing a secure TCP/UDP session includes identifying a security issue affecting a first peer in one or more TCP/UDP sessions, informing a second peer about the security issue using the first peer of the one or more TCP/UDP sessions, and performing at least one action in response to identifying and/or being informed about the security issue.