Abstract: Some embodiments provide novel inline switches that distribute data messages from source compute nodes (SCNs) to different groups of destination service compute nodes (DSCNs). In some embodiments, the inline switches are deployed in the source compute nodes datapaths (e.g., egress datapath). The inline switches in some embodiments are service switches that (1) receive data messages from the SCNs, (2) identify service nodes in a service-node cluster for processing the data messages based on service policies that the switches implement, and (3) use tunnels to send the received data messages to their identified service nodes. Alternatively, or conjunctively, the inline service switches of some embodiments (1) identify service-nodes cluster for processing the data messages based on service policies that the switches implement, and (2) use tunnels to send the received data messages to the identified service-node clusters.

Abstract: Some embodiments provide an elastic architecture for providing a service in a computing system. To perform a service on the data messages, the service architecture uses a service node (SN) group that includes one primary service node (PSN) and zero or more secondary service nodes (SSNs). The service can be performed on a data message by either the PSN or one of the SSN. However, in addition to performing the service, the PSN also performs a load balancing operation that assesses the load on each service node (i.e., on the PSN or each SSN), and based on this assessment, has the data messages distributed to the service node(s) in its SN group. Based on the assessed load, the PSN in some embodiments also has one or more SSNs added to or removed from its SN group. To add or remove an SSN to or from the service node group, the PSN in some embodiments directs a set of controllers to add (e.g., instantiate or allocate) or remove the SSN to or from the SN group.

Abstract: Some embodiments provide an elastic architecture for providing a service in a computing system. To perform a service on the data messages, the service architecture uses a service node (SN) group that includes one primary service node (PSN) and zero or more secondary service nodes (SSNs). The service can be performed on a data message by either the PSN or one of the SSN. However, in addition to performing the service, the PSN also performs a load balancing operation that assesses the load on each service node (i.e., on the PSN or each SSN), and based on this assessment, has the data messages distributed to the service node(s) in its SN group. Based on the assessed load, the PSN in some embodiments also has one or more SSNs added to or removed from its SN group. To add or remove an SSN to or from the service node group, the PSN in some embodiments directs a set of controllers to add (e.g., instantiate or allocate) or remove the SSN to or from the SN group.

Abstract: Some embodiments provide a novel method for load balancing data messages that are sent by a source compute node (SCN) to one or more different groups of destination compute nodes (DCNs). In some embodiments, the method deploys a load balancer in the source compute node's egress datapath. This load balancer receives each data message sent from the source compute node, and determines whether the data message is addressed to one of the DCN groups for which the load balancer spreads the data traffic to balance the load across (e.g., data traffic directed to) the DCNs in the group. When the received data message is not addressed to one of the load balanced DCN groups, the load balancer forwards the received data message to its addressed destination. On the other hand, when the received data message is addressed to one of load balancer's DCN groups, the load balancer identifies a DCN in the addressed DCN group that should receive the data message, and directs the data message to the identified DCN.

Abstract: Some embodiments provide an elastic architecture for providing a service in a computing system. To perform a service on the data messages, the service architecture uses a service node (SN) group that includes one primary service node (PSN) and zero or more secondary service nodes (SSNs). The service can be performed on a data message by either the PSN or one of the SSN. However, in addition to performing the service, the PSN also performs a load balancing operation that assesses the load on each service node (i.e., on the PSN or each SSN), and based on this assessment, has the data messages distributed to the service node(s) in its SN group. Based on the assessed load, the PSN in some embodiments also has one or more SSNs added to or removed from its SN group. To add or remove an SSN to or from the service node group, the PSN in some embodiments directs a set of controllers to add (e.g., instantiate or allocate) or remove the SSN to or from the SN group.

Abstract: Some embodiments provide a novel method for load balancing data messages that are sent by a source compute node (SCN) to one or more different groups of destination compute nodes (DCNs). In some embodiments, the method deploys a load balancer in the source compute node's egress datapath. This load balancer receives each data message sent from the source compute node, and determines whether the data message is addressed to one of the DCN groups for which the load balancer spreads the data traffic to balance the load across (e.g., data traffic directed to) the DCNs in the group. When the received data message is not addressed to one of the load balanced DCN groups, the load balancer forwards the received data message to its addressed destination. On the other hand, when the received data message is addressed to one of load balancer's DCN groups, the load balancer identifies a DCN in the addressed DCN group that should receive the data message, and directs the data message to the identified DCN.

Abstract: A network sensor that features a data store and a packet processing engine. Communicatively coupled to the data store, the packet processing engine is configured to (i) generate a retention priority for at least a first flow within a first storage region of a plurality of storage regions and (ii) identify, in response to an eviction request, the priority of each of the plurality of storage regions. The priority of the first storage region is partially based on the retention priority associated with the first flow while the priority of a second storage region is based on retention priorities associated with flows stored within the second storage region. The packet processing engine also is configured to identify, through use of the retention priorities of the stored flows within the first storage region, which flows are to be retained and which flows are to be evicted.

Abstract: A network sensor that features a data store and a packet processing engine. In communication with the data store, the packet processing engine comprises (1) a cache management logic and (2) deduplication logic. The cache management logic is configured to analyze packets to determine whether (a) a packet under analysis include duplicated data and (b) content of the packet is targeted for storage in a same continuous logical storage area as the duplicated data. The deduplication logic, when activated by the cache management logic, is configured to generate a deduplication reference for insertion into the packet prior to storage.

Abstract: A novel algorithm for packet classification that is based on a novel search structure for packet classification rules is provided. Addresses from all the containers are merged and maintained in a single Trie. Each entry in the Trie has additional information that can be traced back to the container from where the address originated. This information is used to keep the Trie in sync with the containers when the container definition dynamically changes.

Abstract: A novel method for stateful packet classification that uses hardware resources for performing stateless lookups and software resources for performing stateful connection flow handshaking is provided. To classify an incoming packet from a network, some embodiments perform stateless look up operations for the incoming packet in hardware and forward the result of the stateless look up to the software. The software in turn uses the result of the stateless look up to perform the stateful connection flow handshaking and to determine the result of the stateful packet classification.

Abstract: A novel algorithm for packet classification that is based on a novel search structure for packet classification rules is provided. Addresses from all the containers are merged and maintained in a single Trie. Each entry in the Trie has additional information that can be traced back to the container from where the address originated. This information is used to keep the Trie in sync with the containers when the container definition dynamically changes.

Abstract: A novel method for stateful packet classification that uses hardware resources for performing stateless lookups and software resources for performing stateful connection flow handshaking is provided. To classify an incoming packet from a network, some embodiments perform stateless look up operations for the incoming packet in hardware and forward the result of the stateless look up to the software. The software in turn uses the result of the stateless look up to perform the stateful connection flow handshaking and to determine the result of the stateful packet classification.

Abstract: A method is provided that uses a consistent hashing technique to dispatch incoming packets in a stable system prior to adding of a node. The method uses a hash table and assigns hash buckets in the table to each network node. A set of fields in each incoming packet is hashed and is used to identify the corresponding hash bucket. The packets are then dispatched to the network nodes based on the nodes' hash buckets. During an observation period, the method identifies the ongoing sessions by creating a bit vector table that is used to identify the old and new sessions during a re-dispatching period. The method uses the consistent hashing method and the probabilistic method dispatch the incoming packets such that each packet that belongs to an old session is dispatched to the same old node that has been processing the other packets of the session.

Abstract: A large volume natural gas storage tank comprises a plurality of rigid tubular walls each having opposing ends and an intermediate segment with a closed tubular cross-section, the plurality of rigid tubular walls arranged in a closely spaced relationship and interconnected at their ends, with each end of a given of the plurality of rigid tubular walls connected with respective ends of two others of the plurality of rigid tubular walls to define a corner of the storage tank, such that the interiors of the plurality of rigid tubular walls define an interior fluid storage chamber.

Abstract: A server includes a plurality of processors, at least some of the processors being partitioned into virtual partitions using a virtual partition hypervisor. At least one of the virtual partitions executes a virtual machine hypervisor to implement a plurality of virtual machines within said at least one of said virtual partitions. The server also executes a workload manager application configured to dynamically reallocate the processors among the virtual partitions.

Abstract: A large volume natural gas storage tank comprises a plurality of rigid tubular walls each having opposing ends and an intermediate segment with a closed tubular cross-section, the plurality of rigid tubular walls arranged in a closely spaced relationship and interconnected at their ends to form a six-sided storage tank, with each of the six sides of the storage tank defined by four successive of the plurality of rigid tubular walls connected end-to-end, such that the interiors of the plurality of rigid tubular walls define an interior fluid storage chamber; and an exterior support structure, the exterior support structure including one or more braces connected to the exteriors of at least some of the plurality of rigid tubular walls and adapted to reinforce the at least some of the plurality of rigid tubular walls against dynamic loading from fluid in the interior fluid storage chamber.

Abstract: A large volume natural gas storage tank comprises a plurality of rigid tubular walls each having opposing ends and an intermediate segment with a closed tubular cross-section, the plurality of rigid tubular walls arranged in a closely spaced relationship and interconnected at their ends, with each end of a given of the plurality of rigid tubular walls connected with respective ends of two others of the plurality of rigid tubular walls to define a corner of the storage tank, such that the interiors of the plurality of rigid tubular walls define an interior fluid storage chamber.

Abstract: A storage tank containment system including a cubic-shaped tank having an outer shell having cylindrical walls for the efficient storage and transportation of large quantities of fluid, for example, liquid and compressed natural gas.

Abstract: A CNG or LNG storage containment tank is formed from four substantially vertical hollow tubular walls with first and a second ends positioned approximately 90 degrees apart. Eight horizontal hollow tubular walls interconnect and are in in fluid communication with the respective vertical tubular wall ends to form a six-sided cube-shaped tank configuration defining an interior fluid chamber. A tank support connected to the outer surfaces of the tubular walls and configured to reinforce the tank against loading arising from dynamic movement of fluid within the fluid chamber. In one example, bulkheads are positioned inside the horizontal tubular walls to reduce the sloshing of fluid through the tubular walls and thus the resulting sloshing loads. In another example, a plurality of gusset plates are positioned in a space between the tubular walls at an interior of the tank and connected between the tubular walls to further reinforce the tank.

Abstract: The disclosed embodiments provide a system that facilitates communication between a first electronic device and a second electronic device. During operation, the system uses the first electronic device to create a discovery request comprising a first group identifier (ID) associated with the first electronic device, wherein using the first electronic device to create the discovery request involves encrypting the first group ID and including the encrypted first group ID in the discovery request. Next, the system transmits the discovery request to the second electronic device, wherein the discovery request is used by the second electronic device to generate a discovery response to the discovery request.