Abstract: In an embodiment of the invention, a method and system for a per-port penalty queue system in a network device includes: selecting a state for a port in the network device; wherein the selected state comprises either a normal state or a restricted state; wherein the normal state permits a packet received at the port to be copied to a first queue; and wherein the restricted state causes the packet to be copied to a penalty queue which has lower priority than the first queue or causes the packet to not be copied to a queue. In another embodiment of the invention, a method and system permit using the port state for modifying a forwarding decision for a packet, so that the penalized packet will use a sub-optimal or less optimal routing path to the packet destination. In another embodiment of the invention, a method and system permit using the port state as a search key into an access control list (ACL) operation related to packet forwarding decisions or packet filtering decisions.

Abstract: A system for performing an input processing function on a data packet. The system has an input port to which a first processor is coupled, which determines an attribute of the data packet, and a memory coupled to the first processor having a number of queues. The data packet is assigned to one of the queues based upon the attribute determined, which may be an indicator of a priority characterizing said data packet. Input processing is thus performed in a fixed amount of time, deferring variable latency operations until after the input memory.

Abstract: A method for checking expected network traffic is disclosed. The method for checking expected network traffic includes accessing pre-registered expected results of a network traffic checking exercise that include expected packet content verification information for individual packets of the network traffic. In addition, the method includes accessing network traffic where individual packets of the network traffic include actual packet content verification information. Individual packets are identified that have expected packet content verification information that does not match their actual packet content verification information and individual packets are identified that have expected packet content verification information that does match their actual packet content verification information.

Abstract: A method for testing a network device having modules for receiving and sending data packets in a network includes generating in the network device at least one internal data structure associated with a data packet received by the network device from the network. A predefined action on the network device is then preformed responsive to the internal data structure indicating that the data packet satisfies a predefined condition.

Abstract: A system for sharing a computational resource by buffering multiple requests from multiple devices to a memory (e.g. a multi-port RAM or FIFO) in a single clock cycle. The system includes a memory having a first write port and a second write port. A first request input is coupled to the first write port. A second request input is coupled to the second write port. A controller is coupled to the memory. The controller is configured to control the memory to store a first request into the memory via the first write port and a second request into the memory via the second write port. The first and second requests are received via the first and second request inputs and stored into the memory in one clock cycle. Requests are removed from the memory sequentially at a rate that is determined by the shared computational resource.

Abstract: A method for remedying data corruption in a first circuit, which may be a CAM or a TCAM. The method includes providing a RAM circuit external to the first circuit, the RAM circuit being configured for storing error detection information for data stored in the first circuit. The method also includes scrubbing the data stored in the first circuit during scrubbing cycles of the first circuit. The scrubbing corrects stored bit patterns read from the first circuit that fail an error detection test using error detection information corresponding to individual ones of the stored bit patterns. In an embodiment, ECC may be employed for the error detection test and also to correct any single bit error found.

Abstract: In one embodiment of the invention, a method for prioritizing network packets, includes: comparing a packet with at least one copy rule; and if the packet matches the copy rule, then buffering the packet in a queue. The method further includes: processing the packet after buffering the packet in the queue.

Abstract: A method for performing a parallel hash transformation in a network device to generate a hash pointer for an address input. The method includes the step of receiving an address input. The address input is apportioned among a plurality of hashing units. The hashing units are configured to operate in parallel. A hash transformation is executed on the apportioned address inputs in parallel, resulting in a corresponding plurality of hashing unit outputs. The hashing unit outputs are combined to generate a hash result corresponding to the address input.

Abstract: A method for performing a hash transformation in a network device to generate a hash pointer for an address input by using rotation. The method includes to step of receiving an address input. Rotated copies of the address input are subsequently logically combined in accordance with a key to generate a hashing result corresponding to the address input. The hash result is subsequently output.

Abstract: A system for forwarding packets. The system has a first node for creating requests that contain a number of filters for specifying packet forwarding criteria. The first node also specifies values for the filters based on a packet to be forwarded. The system also has a second node coupled to the first node and to a number of ports. The second node has at least one table for specifying which of the ports are to receive the packet based on the filter values. The second node determines which of the ports are to receive the packet based on the table information and the filter values.

Abstract: A method for performing flow based address hash transformation in a network device to generate hash pointers. The method includes the steps of receiving a pair of addresses (source address input and destination address input) corresponding to one direction of a data flow. The destination address input is modified by using a rotation operation. Respective hash operations are subsequently performed on the source address input and modified destination address input. The rotation operation performed on the destination address input prevents aliasing between the hash results for the forward direction of a data flow and the reverse direction, thereby preventing hash pointer collisions.

Abstract: One embodiment disclosed relates to a method for mirroring of select network traffic. A data packet is received by a network device. A determination is made as to whether a designated aspect of the packet matches a flagged entry in a look-up table on the network device. If a match is found, then copy of the packet is sent to an associated mirror destination. Another embodiment disclosed relates to a networking apparatus. The apparatus includes at least an operating system, a look-up table, and a mirroring engine. The operating system includes routines utilized to control the apparatus, and the look-up table includes selection information for mirror sources. The mirroring engine forwards copies of selected packets to a corresponding mirror destination. Another embodiment disclosed relates to a method of selecting packets to mirror that includes checking state information relating to the network traffic against dynamic mirroring criteria.

Abstract: One embodiment disclosed relates to a method for remote mirroring of network traffic. A data packet to be remotely mirrored is received by an entry device. The entry device is pre-configured with a destination address to which to mirror the data packet. The packet to be mirrored is encrypted. An encapsulating header is generated and added to encapsulate the encrypted packet. The encapsulating header includes the aforementioned destination address. The encapsulated packet is forwarded to an exit device associated with the destination address, where the packet may be decapsulated, and then decrypted, before being sent out of a port. In another embodiment, the entry and exit devices are remotely configured with encryption and decryption keys, respectively.

Abstract: One embodiment disclosed relates to a method for remote mirroring of network traffic. A data packet to be remotely mirrored is received by an entry device. The entry device is pre-configured with a destination Internet Protocol (IP) address to which to mirror the data packet. An IP header is generated and added to IP encapsulate the data packet. The IP header includes the aforementioned destination IP address. The IP-encapsulated packet is forwarded to an exit device associated with the destination IP address. Subsequently, the exit device may decapsulate the IP-encapsulated packet to reproduce the original data packet.

Abstract: An embodiment of the invention evaluates the suitability of routes for use in a network route cache. An embodiment of the invention allows the use of network routing caches to be optimized such that routes that are not used to route to a large number of destinations can be offloaded into a less expensive host route cache.

Abstract: A method for performing a hash transformation in a network device to generate a hash pointer for an address input by using rotation. The method includes to step of receiving an address input. Rotated copies of the address input are subsequently logically combined in accordance with a key to generate a hashing result corresponding to the address input. The hash result is subsequently output.

Abstract: A system for sharing a computational resource by buffering multiple requests from multiple devices to a memory (e.g. a multi-port RAM or FIFO) in a single clock cycle. The system includes a memory having a first write port and a second write port. A first request input is coupled to the first write port. A second request input is coupled to the second write port. A controller is coupled to the memory. The controller is configured to control the memory to store a first request into the memory via the first write port and a second request into the memory via the second write port. The first and second requests are received via the first and second request inputs and stored into the memory in one clock cycle. Requests are removed from the memory sequentially at a rate that is determined by the shared computational resource.

Abstract: A method for performing flow based address hash transformation in a network device to generate hash pointers. The method includes the steps of receiving a pair of addresses (source address input and destination address input) corresponding to one direction of a data flow. The destination address input is modified by using a rotation operation. Respective hash operations are subsequently performed on the source address input and modified destination address input. The rotation operation performed on the destination address input prevents aliasing between the hash results for the forward direction of a data flow and the reverse direction, thereby preventing hash pointer collisions.

Abstract: A method for performing a parallel hash transformation in a network device to generate a hash pointer for an address input. The method includes the step of receiving an address input. The address input is apportioned among a plurality of hashing units. The hashing units are configured to operate in parallel. A hash transformation is executed on the apportioned address inputs in parallel, resulting in a corresponding plurality of hashing unit outputs. The hashing unit outputs are combined to generate a hash result corresponding to the address input.

Abstract: A system for performing an input processing function on a data packet. The system has an input port to which a first processor is coupled, which determines an attribute of the data packet, and a memory coupled to the first processor having a number of queues. The data packet is assigned to one of the queues based upon the attribute determined, which may be an indicator of a priority characterizing said data packet. Input processing is thus performed in a fixed amount of time, deferring variable latency operations until after the input memory.