Abstract: A network sensor that features a data store and a packet processing engine. Communicatively coupled to the data store, the packet processing engine is configured to (i) generate a retention priority for at least a first flow within a first storage region of a plurality of storage regions and (ii) identify, in response to an eviction request, the priority of each of the plurality of storage regions. The priority of the first storage region is partially based on the retention priority associated with the first flow while the priority of a second storage region is based on retention priorities associated with flows stored within the second storage region. The packet processing engine also is configured to identify, through use of the retention priorities of the stored flows within the first storage region, which flows are to be retained and which flows are to be evicted.

Abstract: The present disclosure discloses a method and system for achieving enhanced performance for application message handling. The disclosed system includes a device and is configured to receive, at a first processing layer implemented by the device, a message addressed to a first port. The system is further configured to modify the message to be addressed to a second port indicated in a body of the message prior to forwarding the message to a second processing layer implemented by the device. Furthermore, the system is configured to forward, by the first processing layer to the second processing layer, the modified message addressed to the second port.

Abstract: The present disclosure discloses a method and system for achieving enhanced performance for application message handling. The disclosed system includes a device and is configured to receive, at a first processing layer implemented by the device, a message addressed to a first port. The system is further configured to modify the message to be addressed to a second port indicated in a body of the message prior to forwarding the message to a second processing layer implemented by the device. Furthermore, the system is configured to forward, by the first processing layer to the second processing layer, the modified message addressed to the second port.

Abstract: The present disclosure discloses a method and network device for control plane protection for various tables using storm prevention entries. Specifically, the disclosed system receives a first packet, and creates an inactive entry in a table. The system then forwards the first packet from a first processor to a second processor for processing. Also, the system associates the inactive entry with a timestamp indicating when the first packet is forwarded to the second processor, and determines a configured interval (CI) associated with the table. Further, the system compares a difference between a current timestamp and the timestamp associated with the inactive entry against the CI upon receiving a second packet. If the difference is longer than the CI, the system associates the inactive entry with the current timestamp, and forwards the second packet to the second processor for processing. Otherwise, the system discards the second packet.

Abstract: Processing of MLD control packets in an access point (AP) connected to a digital network. According to the present invention, an AP in a network converts MLD queries from multicast to unicast and sends these unicast packets to each client of the AP. These MLD query packets may be filtered or restricted by per-user client rules These MLD query packets may also be tagged as high priority packets to speed their delivery. The AP also suppresses the retransmission of MLD Join packets to clients of the AP.

Abstract: The present disclosure discloses a method and network device for a rate limiting mechanism based on device load/capacity or traffic content. Specifically, the system receives a request from a network node, and determines whether a ratio between a current load and a capacity exceeds a threshold. If so, the system determines a wait time period based on current load/capacity ratio, and responds to the network node with a message including the wait time period. Moreover, the system can inspect content of the request to determine a message type, and whether the message type indicates that the request is associated with dependent messages. If so, the system responds to the request with a busy message including the wait time period. Further, the system rejects new session requests if the number of concurrent sessions currently connected to the network device approaches the number of sessions associated with a regression point.

Abstract: According to one embodiment, a method comprises an operation of determining whether an ingress control message is locally terminated control traffic on a digital device prior to the ingress control message being forwarded to a hardware processor of the digital device for processing. A priority is assigned to the ingress control message based on information within the ingress control message, if the ingress control message is determined to be locally terminated control logic.

Abstract: According to one embodiment, a method comprises an operation of determining whether an ingress control message is locally terminated control traffic on a digital device prior to the ingress control message being forwarded to a hardware processor of the digital device for processing. A priority is assigned to the ingress control message based on information within the ingress control message, if the ingress control message is determined to be locally terminated control logic.

Abstract: A technique is provided for facilitating fabric membership login for an N_Port of a storage area network. A communication from a network node is received. The communication may include a portion of criteria associated with the N_Port. Using at least a portion of the portion of criteria, a virtual fabric identifier corresponding to a virtual fabric which is associated with the N_Port may be automatically identified. Fabric configuration information, which includes the virtual fabric identifier, may be automatically provided to the network node. A fabric login request from the N_Port to login to the virtual fabric may then be received. According to a specific embodiment, the communication may be transmitted from a network node to an F_Port on a Fibre Channel switch.

Abstract: A network sensor that features a data store and a packet processing engine. In communication with the data store, the packet processing engine comprises (1) a cache management logic and (2) deduplication logic. The cache management logic is configured to analyze packets to determine whether (a) a packet under analysis include duplicated data and (b) content of the packet is targeted for storage in a same continuous logical storage area as the duplicated data. The deduplication logic, when activated by the cache management logic, is configured to generate a deduplication reference for insertion into the packet prior to storage.

Abstract: A network sensor that features a data store and a packet processing engine. Communicatively coupled to the data store, the packet processing engine is configured to (i) generate a retention priority for at least a first flow within a first storage region of a plurality of storage regions and (ii) identify, in response to an eviction request, the priority of each of the plurality of storage regions. The priority of the first storage region is partially based on the retention priority associated with the first flow while the priority of a second storage region is based on retention priorities associated with flows stored within the second storage region. The packet processing engine also is configured to identify, through use of the retention priorities of the stored flows within the first storage region, which flows are to be retained and which flows are to be evicted.

Abstract: According to one embodiment, a method comprises an operation of determining whether an ingress control message is locally terminated control traffic on a digital device prior to the ingress control message being forwarded to a hardware processor of the digital device for processing. A priority is assigned to the ingress control message based on information within the ingress control message, if the ingress control message is determined to be locally terminated control logic.

Abstract: The aggregation of packets in a network controller is described. A packet, destined to a station, is received at a network device having a plurality of processors. The packet is queued into a selected queue of a plurality of queues based at least on an identifier of the station and a category associated with the packet. The packet is aggregated with other packets in a selected queue to create an aggregated packet if the selected queue has reached a predetermined size, and the aggregated packet is transmitted to the destination station.

Abstract: The present disclosure discloses a method and network device for an enhanced serialization mechanism. Specifically, the disclosed system receives a plurality of packets from a plurality of transport layer flows corresponding to a security association. Also, the system designates one processor of a plurality of processors to be associated with the security association. Moreover, the system assigns a sequence number to each packet, and transmits the plurality of packets from the plurality of transport layer flows such that packets within the same transport layer flow are transmitted in order of their sequence numbers. However, at least two packets from two different transport layer flows may be transmitted out of incremental order of their sequence number.

Abstract: The present disclosure discloses a method and network device for home VLAN identification for roaming mobile clients. Specifically, the disclosed method and system detects that the mobile client has roamed away from a first network to a second network, maintains a mapping between a virtual local area network (VLAN) corresponding to the mobile client and a tunnel corresponding to a foreign agent in the second network, and forwards packets to or from the mobile client on the VLAN based on the mapping between the VLAN and the tunnel via which the packets are received. Therefore, the disclosed method and system allows for identification of home VLANs for roaming mobile clients without merging VLAN policy configurations at the home agent and the foreign agent.

Abstract: A first data set is derived from a second data set. The first data set is stored in a database of derived data sets. The second data set is updated without updating the first data set, such that the first data set and the second data are inconsistent. The first data set is deleted or updated during batch processing of the database of the derived data sets.

Abstract: The present disclosure discloses a method and network device for achieving enhanced performance with multiple CPU cores in a network device having a symmetric multiprocessing architecture. The disclosed method allows for storing, by each central processing unit (CPU) core, a non-atomic data structure, which is specific to each networking CPU core, in a memory shared by the plurality of CPU cores. Also, the memory is not associated with any locking mechanism. In response to a data packet is received by a particular CPU core, the disclosed system will update a value of the non-atomic data structure corresponding to the particular CPU core. The data structure may be a counter or a fragment table. Further, a dedicated CPU core is allocated to process only data packets received from other CPU cores, and is responsible for dynamically responding to queries receives from a control plane process.

Abstract: A technique is provided for facilitating fabric membership login for an N_Port of a storage area network. A communication from a network node is received. The communication may include a portion of criteria associated with the N_Port. Using at least a portion of the portion of criteria, a virtual fabric identifier corresponding to a virtual fabric which is associated with the N_Port may be automatically identified. Fabric configuration information, which includes the virtual fabric identifier, may be automatically provided to the network node. A fabric login request from the N_Port to login to the virtual fabric may then be received. According to a specific embodiment, the communication may be transmitted from a network node to an F_Port on a Fibre Channel switch.

Abstract: Assigning clients to VLANs on a digital network. A client attaching to a digital network through a network device is initially assigned to a first VLAN. This VLAN may have restricted access and is used for authentication. The device snoops DHCP traffic on this first VLAN rewriting DHCP traffic from the client to request a short lease time for the client. A short lease time may be on the order of 30 seconds. The device optionally rewrites DHCP traffic to the client on the first VLAN to assure a short lease time is returned; this rewriting supports DHCP servers which do not issue short leases. Traffic on this first VLAN may be limited to authentication such as captive portals, 802.1x, Kerberos, and the like. If client authentication on the first VLAN does not succeed, when the short lease expires, the client will receive another short lease on the first VLAN. The network device snoops authentication traffic.

Abstract: A technique is provided for facilitating fabric membership login for an N_Port of a storage area network. A communication from a network node is received. The communication may include a portion of criteria associated with the N_Port. Using at least a portion of the portion of criteria, a virtual fabric identifier corresponding to a virtual fabric which is associated with the N_Port may be automatically identified. Fabric configuration information, which includes the virtual fabric identifier, may be automatically provided to the network node. A fabric login request from the N_Port to login to the virtual fabric may then be received. According to a specific embodiment, the communication may be transmitted from a network node to an F_Port on a Fiber Channel switch.