Abstract: The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The network interface offloads IPsec processing from the host processor. According to the invention, the security system includes two processors for encrypting and authenticating the outgoing data. Outgoing data packets are sent alternately to one or the other processor, whereby transmission processing can be accelerated relative to receive processing.

Abstract: Network interface systems are disclosed comprising a bus interface system, a media access control system, a memory system, a security system for selectively encrypting outgoing data and decrypting incoming data, a checksum system for generating and verifying checksum values, and a segmentation system for selectively segmenting outgoing data, where the network interface system may be fabricated as a single integrated circuit chip. Methods are also provided for interfacing a host system with a network, in which checksum information is obtained from the host system, which is used to generate checksum values for outgoing data while the data is being stored in a network interface memory system.

Abstract: A system includes a plurality of network devices and an external memory. Each network device includes an address table. The external memory includes a group of address tables corresponding to the address tables of the network devices. The system monitors the address table associated with each of the network devices, detects whether one of the address tables has been updated, and updates the corresponding address table in the external memory in response to detecting an update to one of the address tables.

Abstract: The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, a memory system, and a security system. The security system is coupled to the memory system and is adapted to selectively perform security processing on incoming and outgoing data. For at least one of receive or transmit processing, the security system comprises one or more encryption pipelines and at least two sets of one or more authentication pipelines. The encryption pipelines are adapted to perform one or more encryption or decryption algorithms. The authentication pipelines are adapted to perform one or more authentication algorithms. The security system is configured to selectively process frames through the encryption pipelines and then through the two sets of authentication pipelines. The system toggles whereby successive frames alternate between the two sets of authentication pipelines.

Abstract: The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The network interface offloads IPsec processing from the host processor. According to the invention, the security system includes two processors for encrypting and authenticating the outgoing data. Outgoing data packets are sent alternately to one or the other processor, whereby transmission processing can be accelerated relative to receive processing.

Abstract: The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The network interface offloads IPsec processing from the host processor. According to the invention, the security system includes two processors for encrypting and authenticating the outgoing data. Outgoing data packets are sent alternately to one or the other processor, whereby transmission processing can be accelerated relative to receive processing.

Abstract: A security association architecture system of the present invention facilitates network data transfer by providing an internal portion of a security association database that can be quickly accessed to obtain security associations as well as an external component that stores the complete security association database. As a result, at least some security associations for incoming received frames and outgoing transmitted frames can be obtained from the internal portion located on a network interface device without accessing system memory, a host computer, and the like in order to obtain the security associations to perform security processing.

Abstract: The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The security system is operative to selectively authenticate incoming and outgoing data. The security system includes a pipeline that masks mutable fields from incoming data prior to authentication.

Abstract: One aspect of the invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The security system selectively perform security processing on data incoming from the network based on security associations stored in a memory external to the network interface system, typically a host system memory. The security association for any given frame, when available, is fetched from the external memory after the frame begins to arrive in the network interface system based in part on information contained in the frame. Preferably, the fetch begins before the frame is fully received and the security association is queued whereby security processing can begin without having to wait for the security association to be fetched.

Abstract: A network switch includes network switch ports, each including a port filter configured for detecting user-selected attributes from a received layer 2 type data frame. Each port filter, upon detecting a user-selected attribute in a received layer 2 type data frame, sends a signal to a switching module indicating the determined presence of the user-selected attribute, enabling the switching module to generate a switching decision based on the corresponding user-selected attribute and based on a corresponding user-defined switching policy. The switching policy may specify a priority class, or a guaranteed quality of service (e.g., a guaranteed bandwidth), ensuring that the received layer 2 type data frame receives the appropriate switching support. The user-selected attributes for the port filter and the user-defined switching policy for the switching module are programmed by a host processor.

Abstract: Network interface systems are disclosed comprising a bus interface system, a media access control system, a memory system, a security system for selectively encrypting outgoing data and decrypting incoming data, where the network interface system may be fabricated as a single integrated circuit chip. Systems and methods are disclosed wherein out-of-order writing is used to improve throughput for the security system on the receive end.

Abstract: An address lookup table in a multiport switch is implemented as a plurality of address sub-tables. Entries in the address sub-tables are stored at row addresses based on a hash of the information in the entry. Hash collisions are stored in a common heap as a linked list of chained values. Entries in the address sub-tables at any particular address are alternated between the address sub-tables. A search of the address sub-table for the particular entry is performed simultaneously on the plurality of address sub-tables. In this manner, the total memory size of the address table can be increased relative to a single address sub-table while decreasing the length of the longest chain length and the length of the average chain length.

Abstract: A multiport switching device includes a configuration table that stores associations between addresses of subnets directly connected to the switching device and the port number of the multiport switching device that leads to the subnet. A host processor connected to the multiport switching device updates and maintains the configuration table. A remote processor communicates with the switching device through the host processor. To facilitate the communication of the remote processor with the multiport switch, the host processor executes a TCP/IP stack and the multiport switch is assigned a unique IP address.

Abstract: A multiport switching device includes an Internal Rules Checker (IRC) that determines forwarding addresses for packets received at the device. The determined forwarding addresses may include a new MAC destination address that is to substituted for the MAC destination address of the received packet. In one implementation, the new MAC destination address is transmitted from the IRC to the dequeuing logic by transmitting pairs of adjacent words through the switch output queues. In other implementations, the new MAC destination address is transmitted from the IRC to the dequeuing logic by transmitting an index field to the output queuing logic or by having the IRC write the new MAC destination address directly to memory.

Abstract: An address lookup table in a multiport switch is implemented as a plurality of address sub-tables. Entries in the address sub-tables are stored at row addresses based on a hash of the information in the entry. Entries in the address sub-tables are stored in one of the address sub-tables, as determined by pre-selected information relating to the entry. For example, the least significant bit of a source or destination MAC address may be used to select between two address sub-tables. In this manner, the total memory size of the address table can be increased relative to a single address sub-table while decreasing the length of the longest chain and the length of the average chain.

Abstract: One aspect of the invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The security system selectively perform security processing on data incoming from the network based on security associations stored in a memory external to the network interface system, typically a host system memory. The security association for any given frame, when available, is fetched from the external memory after the frame begins to arrive in the network interface system based in part on information contained in the frame. Preferably, the fetch begins before the frame is fully received and the security association is queued whereby security processing can begin without having to wait for the security association to be fetched.

Abstract: A network switch, configured for performing layer 2 and layer 3 switching in an Ethernet (IEEE 802.3) network without blocking of incoming data packets, includes a network switch port having a filter (i.e., a packet classifier module) configured for evaluating an incoming data packet on an instantaneous basis, immediately upon receipt at the network switch port. The filter performs simultaneous comparisons between the incoming data stream of the data packet and multiple templates configured for identifying respective data protocols. Each template is composed of a plurality of min terms, wherein each min term specifies a prescribed comparison operation within a selected data byte of the incoming data packet. The templates may be programmed by a user and stored in an internal min term memory. Moreover, the multiple simultaneous comparisons enable the network switch to perform layer 3 switching for 100 Mbps and gigabit networks without blocking in the network switch.

Abstract: A multiport device includes an internal rules checking (IRC) circuit that makes frame forwarding decisions for frames received from a network. The IRC circuit includes multiple frame lookup components implemented in parallel. More particularly, each of the multiple frame lookup components includes a source address lookup component and a destination address lookup component. The source address and the destination address lookup component of the multiple frame lookup components accesses a common address table to determine the correct forwarding information for a frame. If an address is not present in the table, a source address learning component updates the table. The source address learning component may be shared by each of the multiple frame lookup components.

Abstract: A multiport network device includes output port logic, priority logic, a memory, and memory logic. The output port logic generates output port data that identifies output ports to transmit received packets. The priority logic generates priority data that identifies priorities of the received packets. The memory stores the output port data from the output port logic and the priority data from the priority logic. The memory logic receives priority data relating to one of the received packets from the output port logic, determines whether the memory stores output port data relating to the packet, ignores the received priority data when the memory stores no output port data relating to the packet, and when the memory stores output port data relating to the packet, transmits the received priority data and the stored output port data to the identified output port.

Abstract: A multiport device includes an internal rules checking (IRC) circuit that makes frame forwarding decisions for frames received from a network. The IRC circuit includes multiple frame lookup components implemented in parallel. More particularly, each of the multiple frame lookup components includes a source address lookup component and a destination address lookup component, and an address table. The source address lookup component and the destination address lookup component accesses the address table to determine the correct forwarding information for a frame. If an address is not present in the table, a source address learning component updates the table. The source address learning component may be shared by each of the multiple frame lookup components.