Abstract: Techniques for protecting against denial of service attacks are provided. In one embodiment, a network device can extract one or more values from a Transmission Control Protocol (TCP) ACK packet sent by a client device, where the one or more values encode TCP option information. The network device can further decode the one or more values to determine the TCP option information and embed the TCP option information into the TCP ACK packet. The network device can then forward the TCP ACK packet with the embedded TCP option information to a server.

Abstract: A network device includes a plurality of blades, each having a plurality of CPU cores that process requests received by the network device. Each blade further includes an accumulator circuit. Each accumulator circuit periodically aggregates the local counter values of the CPU cores of the corresponding blade. One accumulator circuit is designated as a master, and the other accumulator circuit(s) are designated as slave(s). The slave accumulator circuits transmit their aggregated local counter values to the master accumulator circuit. The master accumulator circuit aggregates the sets of aggregated local counter values to create a set of global counter values. The master accumulator circuit transmits the global counter values to a management processor (for display), to the CPU cores located on its corresponding blade, and to each of the slave accumulator circuits. Each slave accumulator circuit then transmits the global counter values to the CPU cores located on its corresponding blade.

Abstract: Techniques for efficiently distributing data packets in a network device are provided. In one embodiment, the network device can store a plurality of virtual IP addresses and a plurality of real server IP addresses in an SRAM-based table. The network device can then perform a lookup into the SRAM-based table to determine whether an incoming data packet is part of a first class of data packets destined for a virtual IP address in the plurality of virtual IP addresses, or is part of a second class of data packets originating from a real server IP address in the plurality of real server IP addresses.

Abstract: Techniques for protecting against denial of service attacks are provided. In one embodiment, a network device can extract one or more values from a Transmission Control Protocol (TCP) ACK packet sent by a client device, where the one or more values encode TCP option information. The network device can further decode the one or more values to determine the TCP option information and embed the TCP option information into the TCP ACK packet. The network device can then forward the TCP ACK packet with the embedded TCP option information to a server.

Abstract: Techniques for protecting against denial of service attacks are provided. In one embodiment, a network device can extract one or more values from a Transmission Control Protocol (TCP) ACK packet sent by a client device, where the one or more values encode TCP option information. The network device can further decode the one or more values to determine the TCP option information and embed the TCP option information into the TCP ACK packet. The network device can then forward the TCP ACK packet with the embedded TCP option information to a server.

Abstract: Techniques for enabling flexible flow offload in a Layer 4-7 device are provided. In one embodiment, the device can include a general purpose processor for performing flow-aware processing for a network flow. The device can further include a many-core network processor in communication with the general purpose processor, and a non-transitory computer readable medium having stored thereon program code executable by the many-core network processor. When executed, the program code can cause the many-core network processor to offload at least a portion of the flow-aware processing for at least a portion of the network flow from the general purpose processor, thereby reducing the load on the general purpose processor and improving the overall performance of the device. The nature of the offloading (e.g., timing, portion of the flow offloaded, etc.) can be configurable by an application running on the general purpose processor.

Abstract: Techniques for estimating the performance of a network device. In one set of embodiments, a network device can determine one or more performance metrics associated with a feature of the network device that is customizable by a user. An example of such a feature is a user-defined script that is executed via a scripting engine of the network device. The network device can then generate a performance estimate based on the one or more performance metrics. The performance estimate can indicate the likely performance of the network device with the feature enabled.

Abstract: Techniques for efficiently distributing data packets in a network device are provided. In one embodiment, the network device can store a plurality of virtual IP addresses and a plurality of real server IP addresses in an SRAM-based table. The network device can then perform a lookup into the SRAM-based table to determine whether an incoming data packet is part of a first class of data packets destined for a virtual IP address in the plurality of virtual IP addresses, or is part of a second class of data packets originating from a real server IP address in the plurality of real server IP addresses.

Abstract: A multi-processor architecture for a network device that includes a plurality of barrel cards, each including: a plurality of processors, a PCIe switch coupled to each of the plurality of processors, and packet processing logic coupled to the PCIe switch. The PCIe switch on each barrel card provides high speed flexible data paths for the transmission of incoming/outgoing packets to/from the processors on the barrel card. An external PCIe switch is commonly coupled to the PCIe switches on the barrel cards, as well as to a management processor, thereby providing high speed connections between processors on separate barrel cards, and between the management processor and the processors on the barrel cards.

Abstract: Techniques for implementing application traffic prioritization in a network device are provided. In one embodiment, the network device can determine a packet buffer threshold for a received data packet. The network device can further compare the packet buffer threshold with a current usage of a packet buffer memory that stores data for data packets to be forwarded to a processing core of the network device. If the current usage of the packet buffer memory exceeds the packet buffer threshold, the network device can perform an action on the received data packet.

Abstract: Techniques for estimating the performance of a network device. In one set of embodiments, a network device can determine one or more performance metrics associated with a feature of the network device that is customizable by a user. An example of such a feature is a user-defined script that is executed via a scripting engine of the network device. The network device can then generate a performance estimate based on the one or more performance metrics. The performance estimate can indicate the likely performance of the network device with the feature enabled.

Abstract: A multi-processor architecture for a network device that includes a plurality of barrel cards, each including: a plurality of processors, a PCIe switch coupled to each of the plurality of processors, and packet processing logic coupled to the PCIe switch. The PCIe switch on each barrel card provides high speed flexible data paths for the transmission of incoming/outgoing packets to/from the processors on the barrel card. An external PCIe switch is commonly coupled to the PCIe switches on the barrel cards, as well as to a management processor, thereby providing high speed connections between processors on separate barrel cards, and between the management processor and the processors on the barrel cards.

Abstract: A multi-processor architecture for a network device that includes a plurality of barrel cards, each including: a plurality of processors, a PCIe switch coupled to each of the plurality of processors, and packet processing logic coupled to the PCIe switch. The PCIe switch on each barrel card provides high speed flexible data paths for the transmission of incoming/outgoing packets to/from the processors on the barrel card. An external PCIe switch is commonly coupled to the PCIe switches on the barrel cards, as well as to a management processor, thereby providing high speed connections between processors on separate barrel cards, and between the management processor and the processors on the barrel cards.

Abstract: A network device includes a plurality of blades, each having a plurality of CPU cores that process requests received by the network device. Each blade further includes an accumulator circuit. Each accumulator circuit periodically aggregates the local counter values of the CPU cores of the corresponding blade. One accumulator circuit is designated as a master, and the other accumulator circuit(s) are designated as slave(s). The slave accumulator circuits transmit their aggregated local counter values to the master accumulator circuit. The master accumulator circuit aggregates the sets of aggregated local counter values to create a set of global counter values. The master accumulator circuit transmits the global counter values to a management processor (for display), to the CPU cores located on its corresponding blade, and to each of the slave accumulator circuits. Each slave accumulator circuit then transmits the global counter values to the CPU cores located on its corresponding blade.