Abstract: A network device includes a substring indicator memory and a signature search module for detecting a signature pattern within a stream of network traffic. The signature search module is configured to receive the stream of network traffic, identify a first subject substring from the stream of network traffic, generate a first substring indicator for the first subject substring using a first bitmask on the first subject substring, the first bitmask identifying a plurality of masked bits of the first subject substring, identify a first counter using the first substring indicator as an address into the substring indicator memory, and generate an indication that the signature pattern may be present in the stream of network traffic based on a value of the first counter.

Abstract: A network device includes a substring indicator memory and a signature search module for detecting a signature pattern within a stream of network traffic. The signature search module is configured to receive the stream of network traffic, identify a first subject substring from the stream of network traffic, generate a first substring indicator for the first subject substring using a first bitmask on the first subject substring, the first bitmask identifying a plurality of masked bits of the first subject substring, identify a first counter using the first substring indicator as an address into the substring indicator memory, and generate an indication that the signature pattern may be present in the stream of network traffic based on a value of the first counter.

Abstract: A network device includes a substring indicator memory and a signature search module for detecting a signature pattern within a stream of network traffic. The signature search module is configured to receive the stream of network traffic, identify a first subject substring from the stream of network traffic, generate a first substring indicator for the first subject substring using a first bitmask on the first subject substring, the first bitmask identifying a plurality of masked bits of the first subject substring, identify a first counter using the first substring indicator as an address into the substring indicator memory, and generate an indication that the signature pattern may be present in the stream of network traffic based on a value of the first counter.

Abstract: A network device includes a substring indicator memory and a signature search module for detecting a signature pattern within a stream of network traffic. The signature search module is configured to receive the stream of network traffic, identify a first subject substring from the stream of network traffic, generate a first substring indicator for the first subject substring using a first bitmask on the first subject substring, the first bitmask identifying a plurality of masked bits of the first subject substring, identify a first counter using the first substring indicator as an address into the substring indicator memory, and generate an indication that the signature pattern may be present in the stream of network traffic based on a value of the first counter.

Abstract: A network device includes a substring indicator memory and a signature search module for detecting a signature pattern within a stream of network traffic. The signature search module is configured to receive the stream of network traffic, identify a first subject substring from the stream of network traffic, generate a first substring indicator for the first subject substring using a first bitmask on the first subject substring, the first bitmask identifying a plurality of masked bits of the first subject substring, identify a first counter using the first substring indicator as an address into the substring indicator memory, and generate an indication that the signature pattern may be present in the stream of network traffic based on a value of the first counter.

Abstract: A method and apparatus is provided for scheduling access to a common resource for a plurality of objects queued in a plurality of connection queues. Tokens associated with the connection queues are stored in scheduling queues. Each scheduling queue has a scheduling weight assigned thereto. Each connection queue has a connection weight value assigned thereto. A serving value is used to determine which scheduling queue to select. When a scheduling queue is selected, an object stored in a connection queue having an associated token stored in the selected scheduling queue is provided to the common resource. Tokens are moved among the scheduling queues as a function of the connection weight values, scheduling weights, and serving value. The objects queued in the connection queues may be fixed length cells or variable length packets.

Abstract: Disclosed herein is a system architecture capable of processing fixed length and/or variable length data packets. Under the method of the invention, incoming data packets are queued together according to their corresponding switch processing parameters (SPPs), and then the commonly-queued data packets are processed through a switch fabric as a single unit. In one aspect of the invention, the commonly-queued data packets are processed by the switch fabric as a single train packet. In another aspect of the invention, the commonly-queued data packets are sliced into a set of subtrain packets. A switch fabric then processes the set of subtrain packets in parallel using a plurality of switch planes. Both aspects of the invention can be implemented with a plurality of packet formatters and deformatters linked to a switch fabric in various configurations, including multi-path and hierarchical switching systems. a multichannel switching system.

Abstract: A method and apparatus are provided for building a searchable multi-dimensional index tree that indexes a plurality of data objects. In one aspect of the invention, the index tree divides dataspace into three subspaces and indexes the data objects using a single dimension. If too many data objects map to the same point in that dimension, the dimension is switched to a new dimension of the data object and the data object is indexed using the new dimension. A split node having a split value is used to keep track of the indexing. In another aspect of the invention, the index tree divides dataspace into two subspaces, and equal bits are used in the split nodes to track the content of the data objects in the subspaces. If too many data objects sharing the same key within the same dimension map to a single point, then the dimension is switched to a new dimension and the data objects are indexed using the new dimension.

Abstract: A method and apparatus is provided for scheduling access to a common resource for a plurality of objects queued in a plurality of connection queues. Tokens associated with the connection queues are stored in scheduling queues. Each scheduling queue has a scheduling weight assigned thereto. Each connection queue has a connection weight value assigned thereto. A serving value is used to determine which scheduling queue to select. When a scheduling queue is selected, an object stored in a connection queue having an associated token stored in the selected scheduling queue is provided to the common resource. Tokens are moved among the scheduling queues as a function of the connection weight values, scheduling weights, and serving value. The objects queued in the connection queues may be fixed length cells or variable length packets.

Abstract: A method and apparatus is provided for comparing and sorting data strings of different lengths, in a given character set, and modifying the data such that queries can be run using different search trees. Three different search trees are provided, including: a binary prefix tree and two m_way tree structures, a static m_way prefix tree and a dynamic m_way prefix tree. The data strings may be prefixes of addresses in TCP/IP protocols and searching may be performed using a host address of a computer network. The method further provides for transmitting packet information associated with the network address. Additionally, switching packets in layer 3 and 4 of the TCP/IP protocol and sending the packets to designated ports of a device is provided. The method may also provide differentiated service or data protection, such as a firewall, based on packet classification information.

Abstract: Disclosed herein is a system architecture capable of processing fixed length and/or variable length data packets. Under the method of the invention, incoming data packets are queued together according to their corresponding switch processing parameters (SPPs), and then the commonly-queued data packets are processed through a switch fabric as a single unit. In one aspect of the invention, the commonly-queued data packets are processed by the switch fabric as a single train packet. In another aspect of the invention, the commonly-queued data packets are sliced into a set of subtrain packets. A switch fabric then processes the set of subtrain packets in parallel using a plurality of switch planes. Both aspects of the invention can be implemented with a plurality of packet formatters and deformatters linked to a switch fabric in various configurations, including multi-path and hierarchical switching systems. a multichannel switching system.

Abstract: In communication network, the network blocking probability can be efficiently calculated by applying a Gaussian approximation to a fixed point algorithm. Gaussian curves are approximated to represent state probability distributions of the network links. By efficiently calculating the network blocking probability, the network can be optimally designed by lowering the network blocking probability below a threshold at the least cost.