Abstract: Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms for limiting unauthorized multicast sources. One or more access control lists are typically configured in a switching device to a state that denies forwarding of multicast packets with a particular host as its source. In response to a received multicast application admission-control message identifying the particular host, the one or more access control lists in the switching device are updated to allow multicast messages sent from the particular host to be forwarded. In one system, the received multicast application admission-control message is an Internet Group Management Protocol (IGMP) message.

Abstract: A method and system for processing a packet is disclosed. The method includes identifying the packet as a generic bridge packet tunneling (GBPT) packet, and performing GBPT processing on the packet at a network node, if the packet is a GBPT packet.

Abstract: In accordance with one embodiment of the present invention, a method includes receiving a packet at a physical interface of a network security gateway. The packet is tagged with a first VLAN identifier associated with an external network. The method also includes communicating a copy of the packet to a first processor, analyzing the copy of the packet at the first processor to determine whether the packet violates a security condition, and communicating a reply message from the first processor to the interface. The reply message indicates whether the packet violates a security condition. If the packet does not violate a security condition, the method includes re-tagging the packet with a second VLAN identifier associated with a protected network by using a second processor at the physical interface. The method further includes communicating the re-tagged packet to the protected network if the packet does not violate a security condition.

Abstract: In one embodiment, a rapid spanning tree protocol (RSTP) is executed on an intermediate network device. The RSTP may designate a first port of the device to a Root Port Role and designate one or more second ports of the device to Designated Port Roles, and place the one or more second ports in a forwarding state. Subsequently, the intermediate network device may reassign the Root Port Role from the first port to a third port of the device and blocking the first port. If the intermediate network device receives a proposal bridge protocol data unit (BPDU) message on the third port, rather than transition the one or more second ports to a blocking state, the intermediate device is adapted to maintain the one or more second ports in the forwarding state.

Abstract: A cross stack rapid transition protocol is provided for permitting multiple network devices organized as a stack to rapidly transition their ports in response to network changes so as to minimize traffic flow disruptions while avoiding loops. Each switch in the stack has a stack port that connects the switch to another switch in the stack, and a plurality of ports for connecting the switch to other entities of the computer network. Each switch includes a Spanning Tree Protocol (STP) entity that transitions the ports of the switch among a plurality of states including a forwarding state and a blocking state. Each switch also tracks which other switches are members of the switch stack. The stack port of each switch is transitioned to the forwarding state, and a single switch having connectivity to a root is elected to be a Stack Root. One or more other switches may have Alternate Stack Root Ports, that provide alternate paths to the root.

Abstract: A system and method are provided to prevent the formation of loops in a network. The network device includes a plurality of ports for receiving and forwarding network messages and a spanning tree protocol engine. The spanning tree protocol engine, in one embodiment, implements the Rapid Spanning Tree Protocol (RSTP) to transitions the ports among a plurality port states, including a discarding state, a learning state and a forwarding state. The network device further includes a loop guard engine that is in a communicating relationship with the spanning tree protocol engine and the ports. The loop guard engine monitors the receipt of bridge protocol data units (BPDUs) by the ports. If a given port stops receiving BPDUs, the loop guard engine prevents the spanning tree protocol engine from transitioning the given port to the forwarding state. Instead, the loop guard engine causes the port to transition to loop inconsistent state.

Abstract: A technique optimizes the distribution of authenticated users among a plurality of broadcast domains, such as virtual local area networks (VLAN). Users are dynamically assigned to different broadcast domains based on various factors, including but not limited to the number of authenticated users already participating in each broadcast domain, the available bandwidth in each broadcast domain, user classes associated with users participating in each broadcast domain, etc. Based on one or more of these factors, authenticated users are optimally distributed (“load balanced”) among the plurality of broadcast domains, thereby reducing the amount of broadcast traffic and configuration within each domain.

Abstract: An associative memory with an invert result capability to allow the identification of an entry as being matched when an entry or portion thereof is specifically not matched is disclosed (or alternatively viewed as an entry or portion thereof indicated as matched when it actually was not matched). One such associative memory typically includes multiple associative memory entries, each of which typically includes storage for one or more subsets of bits to be used in matching a lookup value and for one or more invert result indications to identify whether or not corresponding particular subsets of the one or more subsets of bits are to be inverted in producing an entry match result.

Abstract: An optimization to the rapid spanning tree protocol (RSTP) is presented. An intermediate network device configured in accordance with the present invention preferably includes a plurality of ports for receiving and forwarding messages and a spanning tree protocol (STP) engine which is coupled to the ports. If the device receives a bridge protocol data unit (BPDU) message from a designated port of a neighboring intermediate network device and the BPDU represents a proposal by the neighboring device to rapidly transition its port to the forwarding state, the device first determines whether or not it is the root the bridged network. If the device is not the root, and the BPDU message was received on the device's existing root port or on its newly selected root port, the device preferably invokes an “optimal sync” mechanism.

Abstract: A system and method prevents the formation of loops that are not detected by the Spanning Tree Protocol (STP). An intermediate network device preferably includes a plurality of ports for receiving and forwarding network messages and a STP engine in communicating relationship with the ports. The STP engine transitions the ports among a plurality of spanning tree port states, including a discarding state, a learning state and a forwarding state. The device further includes a loop guard engine that is in communicating relationship with the STP engine and the ports. The loop guard engine monitors the receipt of configuration bridge protocol data unit (BPDU) messages by the ports. If a given port stops receiving BPDU messages, the loop guard engine prevents the STP engine from transitioning the given port to the forwarding state. Instead, the loop guard engine preferably causes the port to transition to a new state in which networks messages are explicitly blocked from being forwarded or received.