Abstract: In an embodiment, a method for deep application discovery and forensics of a reference system includes a computing device, such as an orchestrator, receiving and/or obtaining from an inspection layer executing on the reference system, during runtime of the reference system, architecture and configuration information describing the reference system. Also, the computing device generates, during runtime of the reference system, dependency matrices describing relationships between components of the reference system which allow for generation, during runtime of the reference system, at least one threat model describing vulnerabilities of the reference system based on the dependency matrices. The inspection layer identifies the applications and databases accessed by the applications.

Abstract: In an embodiment, a method for deep application discovery and forensics of a reference system includes a computing device, such as an orchestrator, receiving and/or obtaining from an inspection layer executing on the reference system, during runtime of the reference system, architecture and configuration information describing the reference system. Also, the computing device generates, during runtime of the reference system, dependency matrices describing relationships between components of the reference system which allow for generation, during runtime of the reference system, at least one threat model describing vulnerabilities of the reference system based on the dependency matrices. The inspection layer identifies the applications and databases accessed by the applications.

Abstract: A VLAN is implemented with a logical hub and spoke topology that obviates local switching. Member devices are connected to a hub device such as a router via intermediate devices such as Layer 2 switches that support individual IP subnets within the VLAN. The Layer 2 switch does not allow bridging, so there is no IP subnet broadcast domain. Further, the Layer 2 switch implements only a single logical broadcast uplink port which is connected to the router. The Layer 2 switch also implements only point-to-point downlink ports, i.e., to individual member devices. Consequently, all traffic is forced to flow through the router, e.g., broadcast traffic, multicast traffic and traffic of unknown destination received by the Layer 2 switch from a member device is only flooded to the router, and the router performs intra-subnet routing in addition to routing between subnets and between VLANs.

Abstract: Each of first and second bridges of a data network having respective links to an external node implement a network bridge component that forwards traffic inside the data network and a virtual bridge component that forwards traffic outside of the data network. A virtual bridge is formed including the virtual bridge components of the first and second bridges and an interswitch link (ISL) between the virtual bridge components of the first and second bridges. Data frames are communicated with each of multiple external network nodes outside the data network via a respective one of multiple link aggregation groups all commonly supported by the virtual bridge.

Abstract: A switch for a switching network includes a plurality of ports for communicating data traffic and a switch controller that controls switching between the plurality of ports. The switch controller selects a forwarding path for the data traffic based on at least topological congestion information for the switching network. In a preferred embodiment, the topological congestion information includes sFlow topological congestion information and the switch controller includes an sFlow client that receives the sFlow topological congestion information from an sFlow controller in the switching network.

Abstract: A switch for a switching network includes a plurality of ports for communicating data traffic and a switch controller that controls switching between the plurality of ports. The switch controller selects a forwarding path for the data traffic based on at least topological congestion information for the switching network. In a preferred embodiment, the topological congestion information includes sFlow topological congestion information and the switch controller includes an sFlow client that receives the sFlow topological congestion information from an sFlow controller in the switching network.

Abstract: A diagnostic system provides identification of symptoms in a distributed network and an engine for providing recommended rectification of error sources that correspond to the symptoms. The distributed network may be accessed for current statistics. Symptoms may be identified that correspond to the current statistics. A recommended course of action for the distributed network may be provided based on a predetermined list of courses of actions that correspond to rectifying the performance in the error sources.

Abstract: Each of first and second bridges of a data network having respective external links to an external node implement a network bridge component that forwards traffic inside the network and a virtual bridge component that forwards traffic outside of the network. A virtual bridge is formed including the virtual bridge components of the first and second bridges and an interswitch link (ISL) between the virtual bridge components of the first and second bridges. Data frames are redirected via the ISL in response to a link-down condition of one of the external links.

Abstract: Each of first and second bridges of a data network having respective external links to an external node implement a network bridge component that forwards traffic inside the network and a virtual bridge component that forwards traffic outside of the network. A virtual bridge is formed including the virtual bridge components of the first and second bridges and an interswitch link (ISL) between the virtual bridge components of the first and second bridges. Data frames are redirected via the ISL in response to a link-down condition of one of the external links.

Abstract: A switching network includes first, second and third switches coupled for communication, such that the first and third switches communicate data traffic via the second switch. The first switch is operable to request transmission credits from the third switch, receive the transmission credits from the third switch and perform transmission of data traffic in reference to the transmission credits. The third switch is operable to receive the request for transmission credits from the first switch, generate the transmission credits and transmit the transmission credits to the first switch via the second switch. The second switch is operable to modify the transmission credits transmitted by the third switch prior to receipt of the transmission credits at the first switch.

Abstract: A clustered network may include a plurality of switch boxes where a master switch box may communicate and control hardware devices in remote switch boxes. The switch boxes in the network may each include a multiplexer, for example, a field programmable array (FPGA) that may process message requests related to hardware devices of a switch box. If the hardware device is in a remote switch box, then the FPGA of the master switch box may process the status data from the remote switch box so that a local processor in the master switch box can read the status data.

Abstract: A switching network includes an upper tier including a master switch and a lower tier including a plurality of lower tier entities. The master switch includes a plurality of ports each coupled to a respective one of the plurality of lower tier entities. Each of the plurality of ports includes a plurality of virtual ports each corresponding to a respective one of a plurality of remote physical interfaces (RPIs) at the lower tier entity coupled to that port. Each of the plurality of ports also includes a receive interface that, responsive to receipt of data traffic from a particular lower tier entity among the plurality of lower tier entities, queues the data traffic to the virtual port among the plurality of virtual ports that corresponds to the RPI on the particular lower tier entity that was the source of the data traffic.

Abstract: A distributed device architecture includes a master device and one or more member devices. A simple network management protocol (SNMP) agent of a master device receives an SNMP request from a managing device. Where the SNMP request pertains to a given member device, and where the SNMP request requires involvement of the given member device to fulfill the SNMP request, the master device generates a non-SNMP request corresponding to the SNMP request and transmits the non-SNMP request to the given member device. A non-SNMP agent of the given member device processes the non-SNMP request and transmits processing results back to the master device. The master device generates an SNMP response corresponding to the processing results, and the SNMP agent of the master device transmits the SNMP response back to the managing device.

Abstract: Mechanisms for operating a network element in an optical network are disclosed. A network element has a plurality of ports, each port including a respective receive input for receiving an optical signal from another network element and a respective transmit output for transmitting an optical signal to the other network element. Each port is configured with a respective fault detection mode of a plurality of fault detection modes.

Abstract: Flow control of data packets in a network may be enabled to at least one side of a virtual switching interface to provide a lossless environment. In some embodiments, wherever two buffer queues are in communication with at least one buffer queue being connected to a virtual switching interface, flow control may be used to determine if a threshold has been exceeded in one of the buffer queues. When exceeded, the transmission of data packets may cease to one of the buffer queues to prevent packet dropping and loss of data.

Abstract: In a switching network, each of a plurality of lower tier entities is coupled to each of multiple master switches at an upper tier by a respective one of multiple links. At each of the multiple master switches, a plurality of virtual ports each corresponding to a respective one of a plurality of remote physical interfaces (RPIs) at the lower tier are implemented on each of a plurality of ports. Each of the plurality of lower tier entities implements a respective egress port mapping indicating which of its plurality of RPIs transmits egress data traffic through each of its multiple links to the multiple master switches. In response to failure of one of the multiple links coupling a particular lower tier entity to a particular master switch, the particular lower tier entity updates its egress port mapping to redirect egress data traffic to another of the multiple master switches without packet dropping.

Abstract: A switching network includes an upper tier including a master switch and a lower tier including a plurality of lower tier entities. The master switch includes a plurality of ports each coupled to a respective one of the plurality of lower tier entities. Each port includes a plurality of virtual ports each corresponding to a respective one of a plurality of remote physical interfaces (RPIs) at the lower tier entity coupled to that port. Each port also includes a receive interface that, responsive to data traffic from a particular lower tier entity, queues the data traffic to the virtual port that corresponds to the RPI on the particular lower tier entity that was the source of the data traffic. The master switch further includes a switch controller that switches data traffic from the virtual port to an egress port from which the data traffic is forwarded.

Abstract: A switch of a data network implements both a bridge and a virtual bridge. In response to receipt of a data frame by the switch from an external link, the switch performs a lookup in a data structure using a source media access control (SMAC) address specified by the data frame. The switch determines if the external link is configured in a link aggregation group (LAG) and if the SMAC address is newly learned. In response to a determination that the external link is configured in a LAG and the SMAC address is newly learned, the switch associates the SMAC with the virtual bridge and communicates the association to a plurality of bridges in the data network.

Abstract: A switching network includes an upper tier having a master switch and a lower tier including a plurality of lower tier entities. The master switch, which has a plurality of ports each coupled to a respective lower tier entity, implements on each of the ports a plurality of virtual ports each corresponding to a respective one of a plurality of remote physical interfaces (RPIs) at the lower tier entity coupled to that port. Data traffic communicated between the master switch and RPIs is queued within virtual ports that correspond to the RPIs with which the data traffic is communicated. The master switch applies data handling to the data traffic in accordance with a control policy based at least upon the virtual port in which the data traffic is queued, such that the master switch applies different policies to data traffic queued to two virtual ports on the same port of the master switch.

Abstract: In a switching network, each of a plurality of lower tier entities is coupled to each of multiple master switches at an upper tier by a respective one of multiple links. At each of the multiple master switches, a plurality of virtual ports each corresponding to a respective one of a plurality of remote physical interfaces (RPIs) at the lower tier are implemented on each of a plurality of ports. Each of the plurality of lower tier entities implements a respective egress port mapping indicating which of its plurality of RPIs transmits egress data traffic through each of its multiple links to the multiple master switches. In response to failure of one of the multiple links coupling a particular lower tier entity to a particular master switch, the particular lower tier entity updates its egress port mapping to redirect egress data traffic to another of the multiple master switches without packet dropping.