Abstract: Prefix entries are efficiently stored at a networking device for performance of a longest prefix match against the stored entries. A prefix entry generally refers to a data entry which maps a particular prefix to one or more actions to be performed by a networking device with respect to network packets or other data structures associated with a network packet that matches the particular prefix. In the context of a router networking device handling a data packet, the one or more actions may include, for example, forwarding a received network packet to a particular “next hop” networking device in order to progress the network packet towards its final destination, applying firewall rule(s), manipulating the packet, and so forth. To reduce a total amount of space occupied by a prefix tree in storage, each of the nodes of a prefix tree may be configured to store only an incremental portion of a prefix relative to its parent node.

Abstract: Approaches, techniques, and mechanisms are disclosed for assigning paths to network packets. The path assignment techniques utilize path state information and/or other criteria to determine whether to route a packet along a primary candidate path selected for the packet, or one or more alternative candidate paths selected for the packet. According to an embodiment, network traffic is at least partially balanced by redistributing only a portion of the traffic that would have been assigned to a given primary path. Move-eligibility criteria are applied to traffic to determine whether a given packet is eligible for reassignment from a primary path to an alternative path. The move-eligibility criteria determine which portion of the network traffic to move and which portion to allow to proceed as normal. In an embodiment, the criteria and functions used to determine whether a packet is redistributable are adjusted over time based on path state information.

Abstract: Prefix entries are efficiently stored at a networking device for performance of a longest prefix match against the stored entries. A prefix entry generally refers to a data entry which maps a particular prefix to one or more actions to be performed by a networking device with respect to network packets or other data structures associated with a network packet that matches the particular prefix. In the context of a router networking device handling a data packet, the one or more actions may include, for example, forwarding a received network packet to a particular “next hop” networking device in order to progress the network packet towards its final destination, applying firewall rule(s), manipulating the packet, and so forth. To reduce a total amount of space occupied by a prefix tree in storage, each of the nodes of a prefix tree may be configured to store only an incremental portion of a prefix relative to its parent node.

Abstract: Approaches, techniques, and mechanisms are disclosed for assigning paths to network packets. The path assignment techniques utilize path state information and/or other criteria to determine whether to route a packet along a primary candidate path selected for the packet, or one or more alternative candidate paths selected for the packet. According to an embodiment, network traffic is at least partially balanced by redistributing only a portion of the traffic that would have been assigned to a given primary path. Move-eligibility criteria are applied to traffic to determine whether a given packet is eligible for reassignment from a primary path to an alternative path. The move-eligibility criteria determine which portion of the network traffic to move and which portion to allow to proceed as normal. In an embodiment, the criteria and functions used to determine whether a packet is redistributable are adjusted over time based on path state information.

Abstract: This disclosure relates to compressing and/or decompressing a group of similar data units, such as a table or queue of data units processed by a networking device or other computing apparatus. Each data unit in the group may only have values for fields in a master set. The described systems are particularly suited for hardware-level processing of groups of sparsely-populated data units, in which a large number of the data units have values for only a small number of the fields. In an embodiment, non-value carrying fields in a data unit are compressed based on a compression profile selected for the data unit. The compression profile indicates, for each master field, whether the compressed data unit includes a value for that field. Non-value carrying fields are omitted from the compressed data unit. The compression profile also permits compression of value-carrying fields using variable-width field lengths specified in the profile.

Abstract: Approaches, techniques, and mechanisms are disclosed for assigning paths to network packets. The path assignment techniques utilize path state information and/or other criteria to determine whether to route a packet along a primary candidate path selected for the packet, or one or more alternative candidate paths selected for the packet. According to an embodiment, network traffic is at least partially balanced by redistributing only a portion of the traffic that would have been assigned to a given primary path. Move-eligibility criteria are applied to traffic to determine whether a given packet is eligible for reassignment from a primary path to an alternative path. The move-eligibility criteria determine which portion of the network traffic to move and which portion to allow to proceed as normal. In an embodiment, the criteria and functions used to determine whether a packet is redistributable are adjusted over time based on path state information.

Abstract: This disclosure relates to compressing and/or decompressing a group of similar data units, such as a table or queue of data units processed by a networking device or other computing apparatus. Each data unit in the group may only have values for fields in a master set. The described systems are particularly suited for hardware-level processing of groups of sparsely-populated data units, in which a large number of the data units have values for only a small number of the fields. In an embodiment, non-value carrying fields in a data unit are compressed based on a compression profile selected for the data unit. The compression profile indicates, for each master field, whether the compressed data unit includes a value for that field. Non-value carrying fields are omitted from the compressed data unit. The compression profile also permits compression of value-carrying fields using variable-width field lengths specified in the profile.

Abstract: This disclosure relates to compressing and/or decompressing a group of similar data units, such as a table or queue of data units processed by a networking device or other computing apparatus. Each data unit in the group may only have values for fields in a master set. The described systems are particularly suited for hardware-level processing of groups of sparsely-populated data units, in which a large number of the data units have values for only a small number of the fields. In an embodiment, non-value carrying fields in a data unit are compressed based on a compression profile selected for the data unit. The compression profile indicates, for each master field, whether the compressed data unit includes a value for that field. Non-value carrying fields are omitted from the compressed data unit. The compression profile also permits compression of value-carrying fields using variable-width field lengths specified in the profile.

Abstract: This disclosure relates to compressing and/or decompressing a group of similar data units, such as a table or queue of data units processed by a networking device or other computing apparatus. Each data unit in the group may only have values for fields in a master set. The described systems are particularly suited for hardware-level processing of groups of sparsely-populated data units, in which a large number of the data units have values for only a small number of the fields. In an embodiment, non-value carrying fields in a data unit are compressed based on a compression profile selected for the data unit. The compression profile indicates, for each master field, whether the compressed data unit includes a value for that field. Non-value carrying fields are omitted from the compressed data unit. The compression profile also permits compression of value-carrying fields using variable-width field lengths specified in the profile.

Abstract: This disclosure relates to compressing and/or decompressing a group of similar data units, such as a table or queue of data units processed by a networking device or other computing apparatus. Each data unit in the group may only have values for fields in a master set. The described systems are particularly suited for hardware-level processing of groups of sparsely-populated data units, in which a large number of the data units have values for only a small number of the fields. In an embodiment, non-value carrying fields in a data unit are compressed based on a compression profile selected for the data unit. The compression profile indicates, for each master field, whether the compressed data unit includes a value for that field. Non-value carrying fields are omitted from the compressed data unit. The compression profile also permits compression of value-carrying fields using variable-width field lengths specified in the profile.

Abstract: According to one example embodiment, an apparatus may include a media-side physical layer (PHY) block configured to receive a received signal via at least one medium, decode the received signal into data, and send the data to a media-side medium access control (MAC) block, the media-side MAC block configured to receive the data from the media-side PHY layer block, determine a time of receipt of the data, prevent a system-side MAC block from forwarding the data until a predetermined delay after the time of receipt, perform MAC functions on the data, and send the data to the system-side MAC block, the system-side MAC block configured to receive the data and the control time from the media-side MAC block and send the data to a system-side PHY block after the predetermined delay based on signals received from the media-side MAC block, and the system-side PHY block configured to receive the data from the system-side MAC block, encode the data into a transmitted signal, and transmit the transmitted signal to a comp

Abstract: According to one general aspect, a method of using a network device may include receiving, via an ingress port, a data packet that includes a payload portion, a source network address and a destination network address. In various embodiments, the method may also include determining if the data packet includes a security tag that includes a role based authentication tag. In some embodiments, the method may include, if the data packet includes a security tag that includes a role based authentication tag, transmitting, via an egress port, at least the payload portion and the role based authentication tag towards, in a topological sense, the destination network address.

Abstract: An architecture and associated methods and devices are described in which a first selectable data path may be associated with a first port operating at a first data rate, a second selectable data path may be associated with a second port operating at a second data rate, and a third selectable data path may be associated with a third port operating at a third data rate that is higher than the first data rate and the second data rate. A plurality of security engines may be included which may be configurable to provide cipher key-based security for data associated with the first port and the second port using the first selectable path and the second selectable path, respectively, and configurable to provide cipher key-based security of data associated with the third port using the third selectable data path.

Abstract: An architecture and associated methods and devices are described that include a plurality of stages of cipher round logic, each stage configured to perform cryptographic processing of plaintext data in a counter mode and output ciphertext data, a plurality of multipliers, each multiplier configured to receive the ciphertext data output from at least one associated stage of the plurality of stages of cipher round logic and continue the cryptographic processing to output at least a portion of an integrity check value (ICV), and control logic configured to provide a selection between a first option of performing the cryptographic processing at a first data rate using a first number of the plurality of stages and a first number of the plurality of multipliers, and a second option of performing the cryptographic processing at a second data rate using a second number of the plurality of stages and a second number of the plurality of multipliers.

Abstract: According to one example embodiment, an apparatus may include a media-side physical layer (PHY) block configured to receive a received signal via at least one medium, decode the received signal into data, and send the data to a media-side medium access control (MAC) block, the media-side MAC block configured to receive the data from the media-side PHY layer block, determine a time of receipt of the data, prevent a system-side MAC block from forwarding the data until a predetermined delay after the time of receipt, perform MAC functions on the data, and send the data to the system-side MAC block, the system-side MAC block configured to receive the data and the control time from the media-side MAC block and send the data to a system-side PHY block after the predetermined delay based on signals received from the media-side MAC block, and the system-side PHY block configured to receive the data from the system-side MAC block, encode the data into a transmitted signal, and transmit the transmitted signal to a comp

Abstract: According to one general aspect, a method of using a network device may include receiving, via an ingress port, a data packet that includes a payload portion, a source network address and a destination network address. In various embodiments, the method may also include determining if the data packet includes a security tag that includes a role based authentication tag. In some embodiments, the method may include, if the data packet includes a security tag that includes a role based authentication tag, transmitting, via an egress port, at least the payload portion and the role based authentication tag towards, in a topological sense, the destination network address.

Abstract: An architecture and associated methods and devices are described in which a first selectable data path may be associated with a first port operating at a first data rate, a second selectable data path may be associated with a second port operating at a second data rate, and a third selectable data path may be associated with a third port operating at a third data rate that is higher than the first data rate and the second data rate. A plurality of security engines may be included which may be configurable to provide cipher key-based security for data associated with the first port and the second port using the first selectable path and the second selectable path, respectively, and configurable to provide cipher key-based security of data associated with the third port using the third selectable data path.

Abstract: An architecture and associated methods and devices are described that include a plurality of stages of cipher round logic, each stage configured to perform cryptographic processing of plaintext data in a counter mode and output ciphertext data, a plurality of multipliers, each multiplier configured to receive the ciphertext data output from at least one associated stage of the plurality of stages of cipher round logic and continue the cryptographic processing to output at least a portion of an integrity check value (ICV), and control logic configured to provide a selection between a first option of performing the cryptographic processing at a first data rate using a first number of the plurality of stages and a first number of the plurality of multipliers, and a second option of performing the cryptographic processing at a second data rate using a second number of the plurality of stages and a second number of the plurality of multipliers.