Abstract: Two versions of a database can be held in two trees that have many of the same nodes. Both trees can be concurrently searched using recursive algorithms. A root node indicator indicates a root node for a tree search algorithm. The root node indicator can indicate a first root node of a first tree. A tree search algorithm can identify a record node in the first tree. Intermediate nodes between the record node and the first root node can be identified and retained nodes can be identified. A second root node and replacement intermediate nodes can be instantiated. A second tree that includes the second root node, the replacement intermediate node, and the retained nodes can be created. The root node indicator can be set to indicate the second root node after creating the second tree.

Abstract: Network traffic flows can be processed by routers, switches, or service nodes. Service nodes may be ASICs that can provide the functionality of a switch or a router. Service nodes can be configured in a circular replication chain, thereby providing benefits such as high reliability. The service nodes can implement methods that include receiving a first packet that includes a source address in a source address field and that includes a destination address in a destination address field, routing the first packet to a selected service node that is in a circular replication chain that includes a plurality of service nodes that have local flow tables and are configured for chain replication of the local flow tables, producing a second packet by using a matching flow table entry of the first packet to process the first packet, and sending the second packet toward a destination indicated by the destination address.

Abstract: PCIe devices installed in host computers communicating with service nodes can provide virtualized NVMe over fabric services. A workload on the host computer can submit an SQE on a NVMe SQ. The PCI device can read the SQE to obtain a command identifier, an OpCode, and a namespace identifier (NSID). The SQE can be used to produce a LTP packet that includes the opcode, the NSID, and a request identifier. The LTP packet can be sent to the service node, which may access a SAN in accordance with the opcode and NSID, and can respond to the LTP with a second LTP that includes the request identifier and a status indicator. The PCI device can use the status indicator and the request identifier to produce a CQE that is placed on a NVMe CQ associated with the SQ.

Abstract: Network traffic flows can be processed by routers, switches, or service nodes. Service nodes may be ASICs that can provide the functionality of a switch or a router. Service nodes can be configured in a circular replication chain, thereby providing benefits such as high reliability. The service nodes can implement methods that include receiving a first packet that includes a source address in a source address field and that includes a destination address in a destination address field. The first packet can be routed to a selected service node that is in the replication chain that includes a plurality of service nodes that are configured for chain replication of a service state information. A service node configured for NAT or some other service can use the first packet to produce a translated packet that can be transmitted toward a destination indicated by the destination address.

Abstract: Network appliances can use packet processing pipeline circuits to implement network rules for processing network packet flows by configuring the pipeline's processing stages to execute specific policies for specific network packets in accordance with the network rules. Trace reports that indicate network rules implemented at specific processing stages can be more informative than those indicating policies implemented by the processing stages. A method implemented by a network appliance can store network rules for processing network flows by the processing stages of a packet processing pipeline circuit. The method can produce a trace report in response to receiving a trace directive for one of the network flows wherein one of the processing stages has applied a network rule to a network packet in one of the network flows. The trace report can indicate the network rule in association with the processing stage and the network flow.

Abstract: A network appliance or smart switch can include service devices as well as a switching device such as those used in high-speed switches having limited processing ability and are stateless with respect to sessions. Service devices can provide stateful and complex processing. A first exposed port of a switching device can receive network packets and can determine which network packets the service devices are to process to produce processed network packets. A network packet can be sent to a service device in a redirected packet. A processed network packet can be received from a service device in a reinjected packet that is used to recover a port identifier of the first exposed port. The port identifier can be used to determine a network destination of the processed network packet. The processed network packet can be sent from a second exposed port of the switching device toward the network destination.

Abstract: Network appliances can use packet processing pipeline circuits to implement network rules for processing network packet flows by configuring the pipeline's processing stages to execute specific policies for specific network packets in accordance with the network rules. Trace reports that indicate network rules implemented at specific processing stages can be more informative than those indicating policies implemented by the processing stages. A method implemented by a network appliance can store network rules for processing network flows by the processing stages of a packet processing pipeline circuit. The method can produce a trace report in response to to receiving a trace directive for one of the network flows wherein one of the processing stages has applied a network rule to a network packet in one of the network flows. The trace report can indicate the network rule in association with the processing stage and the network flow.

Abstract: An orchestrator can send trace directives to network appliances that indicate a network flow to trace. The network appliances can include packet processing pipelines that each include numerous processing stages. The network appliances implement network rules for processing network flows by configuring the pipeline's processing stages to execute specific policies for specific network packets in accordance with the network rules. The processing stages can also be configured to produce metadata indicating the policies implemented at each stage to process certain network packets in network flows indicated by trace directives. The metadata can be used to produce a trace report that indicates a network packet of the network flow, a first network rule that was applied to the network packet by a one of the first appliance processing stages, and the one of the first appliance processing stages that applied the first network rule to the network packet.

Abstract: PCIe devices installed in host computers communicating with service nodes can provide virtualized and high availability PCIe functions to host computer workloads. The PCIe device can receive a PCIe TLP encapsulated in a PCIe DLLP via a PCIe bus. The TLP includes a TLP address value, a TLP requester identifier, and a TLP type. The PCIe device can terminate the PCIe transaction by sending a DLLP ACK message to the host computer in response to receiving the TLP. The TLP packet can be used to create a workload request capsule that includes a request type indicator, an address offset, and a workload request identifier. A workload request packet that includes the workload request capsule can be sent to a virtualized service endpoint. The service node, implementing the virtualized service endpoint, receives a workload response packet that includes the workload request identifier and a workload response payload.

Abstract: Two versions of a database can be held in two trees that have many of the same nodes. Both trees can be concurrently searched using recursive algorithms. A root node indicator indicates a root node for a tree search algorithm. The root node indicator can indicate a first root node of a first tree. A tree search algorithm can identify a record node in the first tree. Intermediate nodes between the record node and the first root node can be identified and retained nodes can be identified. A second root node and replacement intermediate nodes can be instantiated. A second tree that includes the second root node, the replacement intermediate node, and the retained nodes can be created. The root node indicator can be set to indicate the second root node after creating the second tree.

Abstract: Network traffic flows can be processed by routers, switches, or service nodes. Service nodes may be ASICs that can provide the functionality of a switch or a router. Service nodes can be configured in a circular replication chain, thereby providing benefits such as high reliability. The service nodes can implement methods that include receiving a first packet that includes a source address in a source address field and that includes a destination address in a destination address field. The first packet can be routed to a selected service node that is in the replication chain that includes a plurality of service nodes that are configured for chain replication of a service state information. A service node configured for NAT or some other service can use the first packet to produce a translated packet that can be transmitted toward a destination indicated by the destination address.

Abstract: PCIe devices installed in host computers communicating with service nodes can provide virtualized NVMe over fabric services. A workload on the host computer can submit an SQE on a NVMe SQ. The PCI device can read the SQE to obtain a command identifier, an OpCode, and a namespace identifier (NSID). The SQE can be used to produce a LTP packet that includes the opcode, the NSID, and a request identifier. The LTP packet can be sent to the service node, which may access a SAN in accordance with the opcode and NSID, and can respond to the LTP with a second LTP that includes the request identifier and a status indicator. The PCI device can use the status indicator and the request identifier to produce a CQE that is placed on a NVMe CQ associated with the SQ.

Abstract: PCIe devices installed in host computers communicating with service nodes can provide virtualized and high availability PCIe functions to host computer workloads. The PCIe device can receive a PCIe TLP encapsulated in a PCIe DLLP via a PCIe bus. The TLP includes a TLP address value, a TLP requester identifier, and a TLP type. The PCIe device can terminate the PCIe transaction by sending a DLLP ACK message to the host computer in response to receiving the TLP. The TLP packet can be used to create a workload request capsule that includes a request type indicator, an address offset, and a workload request identifier. A workload request packet that includes the workload request capsule can be sent to a virtualized service endpoint. The service node, implementing the virtualized service endpoint, receives a workload response packet that includes the workload request identifier and a workload response payload.

Abstract: Network traffic flows can be processed by routers, switches, or service nodes. Service nodes may be ASICs that can provide the functionality of a switch or a router. Service nodes can be configured in a circular replication chain, thereby providing benefits such as high reliability. The service nodes can implement methods that include receiving a first packet that includes a source address in a source address field and that includes a destination address in a destination address field, routing the first packet to a selected service node that is in a circular replication chain that includes a plurality of service nodes that have local flow tables and are configured for chain replication of the local flow tables, producing a second packet by using a matching flow table entry of the first packet to process the first packet, and sending the second packet toward a destination indicated by the destination address.

Abstract: A network appliance can queue a first packet and a second packet of a network traffic flow in an input queue of a match-action pipeline. The match-action pipeline can be implemented via a packet processing circuit of the network appliance and can be configured to process a plurality of network traffic flows. Submitting the first packet to the match-action pipeline can cause a first flow miss. The second packet can be moved to a burst queue of the network appliance and a match-action configuration can be generated based on the first packet. The second packet can be moved from the burst queue to the input queue after the match-action pipeline is configured with the match-action configuration. The match-action pipeline can then process the second packet.

Abstract: A network appliance running a first firmware may roll back to that first firmware in a hitless manner during an unsuccessful upgrade to a second firmware. Before the attempted upgrade, a first process in the first firmware is providing a service. The upgrade process is initiated to upgrade the network appliance from the first firmware to a second firmware. The upgrade process can include stopping communication via a data plane of the network appliance to the first process, and detecting an upgrade failure. The upgrade process is hitless because rolling back the upgrade process occurs without halting the first firmware. Rolling back the upgrade includes restoring communications via the data plane to the first process.

Abstract: A network appliance can queue a first packet and a second packet of a network traffic flow in an input queue of a match-action pipeline. The match-action pipeline can be implemented via a packet processing circuit of the network appliance and can be configured to process a plurality of network traffic flows. Submitting the first packet to the match-action pipeline can cause a first flow miss. The second packet can be moved to a burst queue of the network appliance and a match-action configuration can be generated based on the first packet. The second packet can be moved from the burst queue to the input queue after the match-action pipeline is configured with the match-action configuration. The match-action pipeline can then process the second packet.

Abstract: Systems, methods, and non-transitory computer-readable storage media for recovering from a partial failure of a virtual port chain (vPC) domain. The first and second vPC peers may be paired to create a vPC having a virtual address. An endpoint host may communicate with a network via the virtual port channel. The system may detect that the first virtual port channel peer is down. During or after the first vPC reboots, the reachability cost for the first vPC with regards to the virtual address can be set to an inflated value. The first vPC peer may also delay its bring up time while it synchronizes its vPC state information with the second vPC peer. The second vPC can continue to advertise the association between the endpoint host and the virtual address. Upon completion of the synchronization, the first vPC peer may bring up the link and restore the reachability cost.

Abstract: Systems, methods, and non-transitory computer-readable storage media for recovering from a partial failure of a virtual port chain (vPC) domain. The first and second vPC peers may be paired to create a vPC having a virtual address. An endpoint host may communicate with a network via the virtual port channel. The system may detect that the first virtual port channel peer is down. During or after the first vPC reboots, the reachability cost for the first vPC with regards to the virtual address can be set to an inflated value. The first vPC peer may also delay its bring up time while it synchronizes its vPC state information with the second vPC peer. The second vPC can continue to advertise the association between the endpoint host and the virtual address. Upon completion of the synchronization, the first vPC peer may bring up the link and restore the reachability cost.

Abstract: Systems, methods, and non-transitory computer-readable storage media for recovering from a partial failure of a virtual port chain (vPC) domain. The first and second vPC peers may be paired to create a vPC having a virtual address. An endpoint host may communicate with a network via the virtual port channel. The system may detect that the first virtual port channel peer is down. During or after the first vPC reboots, the reachability cost for the first vPC with regards to the virtual address can be set to an inflated value. The first vPC peer may also delay its bring up time while it synchronizes its vPC state information with the second vPC peer. The second vPC can continue to advertise the association between the endpoint host and the virtual address. Upon completion of the synchronization, the first vPC peer may bring up the link and restore the reachability cost.