Abstract: Methods and apparatus for providing one-arm node clustering using a port channel are provided herein. An example application node may be communicatively connected to at least one application node, and the application node may be connected to a network through a port channel. The application node may include: a link included in the port channel for accommodating the network data being communicated between the remote client and server; and a processor configured to send/receive a cluster control packet to/from the at least one application node through the link included in the port channel.

Abstract: Embodiments of the invention improve the detection of malicious software applications, such as a rootkit, on hosts configured to access storage volumes over a storage area network (SAN). A rootkit detection program running on a switch may be configured to detect rootkits present on the storage volumes of the SAN. Because the switch may mount and access storage volumes independently from the (possibly comprised) hosts, the rootkit is not able to conceal itself from the rootkit detection program running on the switch.

Abstract: Techniques and a network edge device are provided herein to extend local area networks (LANs) and storage area networks (SANs) beyond a data center while converging the associated local area network and storage area network host layers. A packet is received at a device in a network. It is determined if the packet is routed to a local or remote storage area network or local area network. In response to determining that the packet routed to a remote storage area network, storage area network extension services are performed with respect to the packet in order to extend the storage area network on behalf of a remote location. In response to determining that the packet is routed to a local local area network traffic, local area network extension services are performed with respect to the packet in order to extend the local area network on behalf of the remote location.

Abstract: An example method includes disengaging a target node from a cluster, where the disengaging comprises: selecting an inheritor; migrating flows from the target node to the inheritor; informing a migration manager that the target node is disengaged from the cluster; and broadcasting to peer nodes of the target node that the target node is replaced by the inheritor. In particular implementations of the present disclosure, the cluster can include a first layer of a network topology including a forwarding engine that implements hash-based packet forwarding; a second layer of the network topology comprising the target node and the inheritor, where the target node and the inheritor implement flow-based packet forwarding; and a third layer including service nodes configured for packet processing in a network.

Abstract: Systems and methods for providing service virtualization endpoint (SVE) redundancy in a two-node, active-standby form. An active-standby pair of SVEs register with a cloud-centric-network control point (CCN-CP) as a single service node (SN) using a virtual IP address for both a control-plane and a data-plane. At any given time, only the active SVE is a host for the control-plane and the data-plane. When a failover happens, the hosting operation is taken over by the standby SVE, therefore the failover will be transparent to CCN-CP and the SN.

Abstract: Methods and apparatus provide formation and management of intelligent application clusters in a storage area network. Disk arbitration mechanisms ensure that a cluster is owned by a single member. In the event of a network partition, each cluster member involved arbitrates to gain ownership of a cluster. High availability mechanisms allow monitoring of system resources and effective failover capabilities.

Abstract: Zone information is automatically and dynamically configured and managed in a fiber channel storage area network upon detection of network events. Some examples of events that trigger automatic dynamic zone updates include virtual port creation, intrusion/anomaly detection, arbitration decision completion, misconfiguration detection, and device malfunction. The newly created/updated zones are propagated through the fiber channel fabric and provide access control.

Abstract: Techniques and a network appliance apparatus are provided herein to extend local area networks (LANs) and storage area networks (SANs) beyond a data center while converging the associated local area network and storage area network host layers. A service flow is received at a device in a network. It is determined if the service flow is associated with storage area network or with local area network traffic. In response to determining that the service flow is storage area network traffic, storage area network extension services are performed with respect to the service flow in order to extend the storage area network on behalf of a remote location. In response to determining that the service flow is local area network traffic, local area network extension services are performed with respect to the service flow in order to extend the local area network on behalf of the remote location.

Abstract: Methods and apparatus for performing SPAN for a virtual port are disclosed. Specifically, a frame is received from a first port. The frame or a copy thereof is transmitted to a second port, where the second port is identified in a header of the frame. At least one of the first port and the second port is a virtual port. The frame or a copy thereof is also transmitted to a third port, thereby enabling an analyzer coupled to the third port to analyze traffic received by the third port.

Abstract: Disclosed is a session modification mechanism for altering a data tapping process in a storage area network (SAN). In general, a data tapping mechanism is set up so that an appliance receives SAN data that is tapped from a particular SAN session. That is, the data tapping mechanism provides to a particular appliance a copy of the SAN data that is being written from a particular host to a particular storage device. The session modification mechanism allows the appliance to alter various aspects of the SAN session that is to be (or is being) tapped.

Abstract: Methods and apparatus for performing SPAN for a virtual port are disclosed. Specifically, a frame is received from a first port. The frame or a copy thereof is transmitted to a second port, where the second port is identified in a header of the frame. At least one of the first port and the second port is a virtual port. The frame or a copy thereof is also transmitted to a third port, thereby enabling an analyzer coupled to the third port to analyze traffic received by the third port.

Abstract: In one embodiment, a network device receives a port login directed to a target from a first host. The network device determines whether at least one other host is currently logged in to the target. The network device may then send a port login to the target corresponding to whether at least one other host is currently logged in to the target.

Abstract: In one embodiment, a MUD logger receives a notification from another MUD logger maintaining another MUD log for a volume, the notification indicating one or more modifications to be made to a MUD log maintained by the MUD logger receiving the notification, wherein the MUD log includes information for one or more epochs, wherein the information for each of the epochs indicates a set of one or more regions of the volume that have been modified during the corresponding epoch. The MUD logger updates the MUD log associated with the volume, wherein updating the MUD log is performed in response to the notification.

Abstract: A technique is provided for implementing online restriping of a volume in a storage area network. A first instance of the volume is instantiated at a first port of the fibre channel fabric for enabling I/O operations to be performed at the volume. While restriping operations are being performed at the volume, the first port is able to concurrently perform I/O operations at the volume.

Abstract: Methods and apparatus provide formation and management of intelligent application clusters in a storage area network. Disk arbitration mechanisms ensure that a cluster is owned by a single member. In the event of a network partition, each cluster member involved arbitrates to gain ownership of a cluster. High availability mechanisms allow monitoring of system resources and effective failover capabilities.

Abstract: Disclosed are methods and apparatus for detecting anomalies in a storage area network (SAN). Provided are one or more anomaly type(s) and corresponding actions to be performed when the one or more anomaly types are detected. Traffic in the SAN is then inspected in order to detect the one or more provided anomaly type(s). When a one of the provided one or more anomaly type(s) is detected, one or more of the corresponding action(s) is performed. The provided anomaly type(s) may include one or more of the following: a read or write access pattern anomaly, excessive login or control requests, a bandwidth usage anomaly, a configuration anomaly, and a hardware anomaly.

Abstract: Methods and apparatus are provided for detecting and maintaining version compatibility in network devices. Interfaces associated with network devices and components are controlled in order to generate compatibility information at compile time. Version compatibility information embedded in image headers is checked during installation. Version compatibility information is also used to generate access control lists. Access control lists prevent incompatible device communication during run time.

Abstract: Methods and apparatus provide formation and management of intelligent application clusters in a storage area network. Disk arbitration mechanisms ensure that a cluster is owned by a single member. In the event of a network partition, each cluster member involved arbitrates to gain ownership of a cluster. High availability mechanisms allow monitoring of system resources and effective failover capabilities.

Abstract: The disclosed embodiments support improvements in network performance in networks such as storage area networks. This is particularly important in networks such as those implementing virtualization. These improvements, therefore, support improved mechanisms for performing processing in network devices such as switches, routers, or hosts. These improvements include various different mechanisms which may be used separately or in combination with one another. These mechanisms include methods and apparatus for processing traffic in an arbitrated loop, performing striping to support fairness and/or loop tenancy, performing configuration of network devices such as switches to enable virtualization to be performed closest to the storage device (e.g., disk), ascertaining a CPU efficiency that quantifies the impact of virtualization on a processor, and configuring or accessing a striped volume to account for metadata stored in each storage partition.

Abstract: In one embodiment, a MUD logger receives a notification from another MUD logger maintaining another MUD log for a volume, the notification indicating one or more modifications to be made to a MUD log maintained by the MUD logger receiving the notification, wherein the MUD log includes information for one or more epochs, wherein the information for each of the epochs indicates a set of one or more regions of the volume that have been modified during the corresponding epoch. The MUD logger updates the MUD log associated with the volume, wherein updating the MUD log is performed in response to the notification.