Abstract: An integrated circuit includes a processor and an exact-match flow table structure. A first packet is received onto the integrated circuit. The packet is determined to be of a first type. As a result of this determination, execution by the processor of a first sequence of instructions is initiated. This execution causes bits of the first packet to be concatenated and modified in a first way, thereby generating a first Flow Id. The first Flow Id is an exact-match for the Flow Id of a first stored flow entry. A second packet is received. It is of a first type. As a result, a second sequence of instructions is executed. This causes bits of the second packet to be concatenated and modified in a second way, thereby generating a second Flow Id. The second Flow Id is an exact-match for the Flow Id of a second stored flow entry.

Abstract: An integrated circuit includes a processor and an exact-match flow table structure. A first packet is received onto the integrated circuit. The packet is determined to be of a first type. As a result of this determination, execution by the processor of a first sequence of instructions is initiated. This execution causes bits of the first packet to be concatenated and modified in a first way, thereby generating a first Flow Id. The first Flow Id is an exact-match for the Flow Id of a first stored flow entry. A second packet is received. It is of a first type. As a result, a second sequence of instructions is executed. This causes bits of the second packet to be concatenated and modified in a second way, thereby generating a second Flow Id. The second Flow Id is an exact-match for the Flow Id of a second stored flow entry.

Abstract: An integrated circuit includes a processor and an exact-match flow table structure. A first packet is received onto the integrated circuit. The packet is determined to be of a first type. As a result of this determination, execution by the processor of a first sequence of instructions is initiated. This execution causes bits of the first packet to be concatenated and modified in a first way, thereby generating a first Flow Id. The first Flow Id is an exact-match for the Flow Id of a first stored flow entry. A second packet is received. It is of a first type. As a result, a second sequence of instructions is executed. This causes bits of the second packet to be concatenated and modified in a second way, thereby generating a second Flow Id. The second Flow Id is an exact-match for the Flow Id of a second stored flow entry.

Abstract: A Software-Defined Networking (SDN) switch includes external network ports for receiving external network traffic onto the SDN switch, external network ports for transmitting external network traffic out of the SDN switch, a first Network Flow Switch (NFX) integrated circuit that has multiple network ports and that maintains a first flow table, another Network Flow Switch (NFX) integrated circuit that has multiple network ports and that maintains a second flow table, a Network Flow Processor (NFP) circuit that maintains a third flow table, and a controller processor circuit that maintains a fourth flow table. The controller processor circuit is coupled by a serial bus to the NFP circuit but is not directly coupled by any network port to either the NFP circuit nor the first NFX integrated circuit nor the second NFX integrated circuit.

Abstract: A method involves a Software-Defined Networking (SDN) switch that includes multiple Network Flow Switch (NFX) integrated circuits, a Network Flow Processor (NFP) circuit, and a controller processor. The controller processor is coupled to the NFP circuit by a serial bus. A flow table is maintained on each of the NFX integrated circuits. A SDN flow table is maintained on the NFP circuit. A copy of each of the flow tables is maintained on the NFP circuit. Another SDN flow table is maintained on the controller processor. A SDN protocol stack is executed on the controller processor. A SDN protocol message is received onto the SDN switch via one of the NFX integrated circuits. The SDN protocol message is communicated across a network link to the NFP circuit, and across the serial bus from the NFP circuit to the controller processor such that the SDN protocol message is received and processed by the SDN protocol stack executing on the controller processor.

Abstract: An exact-match flow table structure of an integrated circuit stores flow entries. Each flow entry includes a Flow Id and an action value. Each Flow Id is a multi-bit digital value that uniquely identifies a flow. A Flow Id does not include any wildcard indictor. The flow table structure cannot and does not store an indicator that any particular part of a packet should be matched against any part of a Flow Id. In one example, a packet is received onto the integrated circuit. A Flow Id is generated from the packet. If the flow table structure determines that the Flow Id is a bit-by-bit exact-match of any Flow Id of any stored flow entry, then the packet is handled according to the action value of the flow entry. If, on the other hand, there is not exact-match, then a miss indication is output from the integrated circuit.

Abstract: An exact-match flow table structure stores flow entries. Each flow entry includes a Flow Id. A flow entry is generated from an incoming packet. The flow table structure determines whether there is a stored flow entry, the Flow Id of which is an exact-match for the generated Flow Id. In one novel aspect, a programmable reduce table circuit is used to generate a Flow Id. A selected subset of bits of an incoming packet is supplied as an address to an SRAM, so that the SRAM outputs a data value. The data value is supplied to a programmable lookup circuit such that the lookup circuit performs a selected type of lookup operation, and outputs a result value of a reduced number of bits. A multiplexer circuit is used to form a Flow Id such that the result value is a part of the Flow Id.

Abstract: An integrated circuit includes an exact-match flow table structure, a crossbar switch, and an egress packet modifier. Each flow entry includes an egress action value, an egress flow number, and an egress port number. A Flow Id is generated from an incoming packet. The Flow Id is used to obtain a matching flow entry. A portion of the packet is communicated across the crossbar switch to the egress packet modifier, along with the egress action value and flow number. The egress action value is used to obtain non-flow specific header information stored in a first egress memory. The egress flow number is used to obtain flow specific header information stored in a second egress memory. The egress packet modifier adds the header information onto the portion of the packet, thereby generating a complete packet. The complete packet is then output from an egress port indicated by the egress port number.

Abstract: An exact-match flow table structure stores flow entries. Each flow entry includes a Flow Id and an action value. A flow entry is generated from an incoming packet. The flow table structure determines whether there is a stored flow entry, the Flow Id of which is an exact-match for generated Flow Id. In one novel aspect, a multiplexer circuit is used to generate Flow Ids. The multiplexer circuit includes a plurality of byte-wide multiplexer. Each respective one of the byte-wide multiplexers outputs a byte that is a corresponding respective byte of the Flow Id. The various inputs of the byte-wide multiplexers are coupled to receive various bytes of the incoming packet, various bytes of modified or compressed packet data, as well as bytes of metadata. By controlling select values supplied onto the select inputs of the multiplexer circuit, Flow Ids of different forms can be generated.

Abstract: A method of Software-Defined Networking (SDN) switching. A packet of a flow is received onto a SDN switch via a NFX circuit. The NFX circuit determines that the packet matches a flow entry stored in any flow table in the NFX circuit, counts the number of packets of the flow received, and determines that the number of packets of the flow received is above a threshold value. The NFX circuit then forwards the packet to a NFP circuit in the SDN switch. The NFP circuit determines that the packet matches a flow entry stored in the flow table in the NFX and generates a new flow entry that applies to a relatively narrow subflow of packets that is forwarded to and stored the flow table in the NFX circuit. A subsequent packet of the flow is switched by the SDN switch without forwarding the packet to the NFP.

Abstract: A Software-Defined Networking (SDN) switch that includes external network ports for receiving external network traffic onto the SDN switch, external network ports for transmitting external network traffic out of the SDN switch, a Network Flow Switch (NFX) integrated circuit that has multiple network ports and that maintains a flow table, another NFX integrated circuit that has multiple network ports and that maintains a flow table, and a Network Flow Processor (NFP) circuit that maintains a flow table. The NFP circuit couples directly to a network port of the first NFX integrated circuit but does not couple directly to any network port of the second NFX integrated circuit. The NFP circuit sends a flow entry to one NFX integrated circuit along with an addressing label and the NFX integrated circuit uses the addressing label to determine that the flow entry is to be forwarded to the second NFX integrated circuit.

Abstract: An integrated circuit includes an input port, a first Characterize/Classify/Table Lookup and Multiplexer Circuit (CCTC), a second CCTC, and an exact-match flow table structure. The first and second CCTCs are structurally identical. The first and second CCTs are coupled together serially. In one example, an incoming packet is received onto the integrated circuit via the input port and packet information is supplied to a first characterizer of the first CCTC. Information flow passes through the classifier of the first CCT, through the Table Lookup and Multiplexer Circuit (TLMC) of the first CCT, through the characterizer of the second CCT, through the classifier of the second CCT, and out of the TLMC of the second CCT in the form of a Flow Id. The Flow Id is supplied to the exact-match flow table structure to determine whether an exact-match for the Flow Id is found in the flow table structure.

Abstract: An integrated circuit includes ingress ethernet ports and egress ethernet ports. A second ingress ethernet port is configurable to operate in a selected one of a command mode and a data mode. The ingress ethernet port does not power up in the command mode and can only be put into the command mode as a result of a port modeset command being received onto an ingress ethernet port operating in the command mode. A first ingress ethernet port powers up in the command mode. In the command mode the first ingress ethernet port can receive and carry out a port modeset command. Receiving and carrying out of the port modeset command causes one of the ingress ethernet ports identified by the port modeset command to operate in the command mode. A flow table structure adapted to store flow entries is used to determine which egress ethernet port outputs a packet.

Abstract: A method involving a Software-Defined Networking (SDN) switch. A packet is received onto a SDN switch via a NFX circuit. The NFX circuit determines that the packet matches no flow entry stored in any flow table in the NFX circuit and forwards the packet to a NFP circuit. The NFP circuit determines that the packet matches a first flow entry that applies to a relatively broad flow of packets stored in a flow table in the NFP circuit, generates a new flow entry that applies to a relatively narrow subflow of packets, and forwards the new flow entry to the NFX circuit that stores the new flow entry in a flow table in the NFX circuit. A subsequent packet is received onto the SDN switch via the NFX circuit and is switched using the new flow entry stored in the NFX circuit without forwarding the packet to the NFP circuit.

Abstract: A communications system in which a first node is connected to a plurality of second nodes for controlling the operation of the second nodes. The plurality of second nodes is arranged in one or more logical interconnects, the topology of the one or more logical interconnects being distinct from the topology of the physical interconnection of the nodes. Each second node sends status messages to its logical successor node and monitors the status messages received from its logical predecessor node for determining the status thereof.

Abstract: A communications system has a plurality of islands, and a media path having resources for carrying data in a plurality of calls between first and second ones of the islands. Each of the first and second islands has a controller for managing allocation of the resources of the media path between the plurality of calls. A faulty controller is detected, and either replaced with a working replacement controller or recovered to working order. A further controller provides to the replacement or recovered controller, on replacement or recovery, information on the allocation of the resources of the media path.

Abstract: Malicious code in a code-executing device is detected by generating test data, which is substantially unsusceptible to compression without reducing its information content, and storing it as image data in memory external to the device. The test data is stored into memory of the device. A checksum calculation is performed on the test data stored in the memory of the device to generate a first checksum value. A corresponding checksum calculation is performed on the image data to generate a second checksum value. The first value is compared with the second value to determine whether or not the test data in the memory of the device has been corrupted. These steps are repeated until sufficient test data in the memory of the device is checksum tested to determine whether or not malicious code is present in the device. The malicious code is difficult to conceal itself from the checksums. Hence, it is possible to determine whether or not the device has been compromised.

Abstract: The invention provides a method of detecting malicious code in a code-executing device (10), the method characterised in that it includes the steps of: (a) generating test data which is substantially unsusceptible to compression without reducing its information content and storing it as image data (230) in memory external to the device (10); (b) loading the test data (R0 to Rm) into memory (30) of the device (10); (c) performing a checksum calculation on the test data (R0 to Rm) stored in the memory (30) of the device (10) to generate a first checksum value, performing a corresponding checksum calculation on the image data (230) to generate a second checksum value, and the comparing the first value with the second value to determine whether or not the test data in the memory of the device (30) has been corrupted; (d) repeating step (c) until sufficient test data in the memory (30) of the device (10) is checksum tested to determine whether or not malicious code is present in the device (10).

Abstract: A communications system comprising a plurality of islands, a media path comprising resources for carrying data in a plurality of calls between first and second ones of the islands in which each of the first and second islands comprises control means for managing allocation of the resources of the media path between the plurality of calls; in which the system also comprises means for detecting a faulty control means and either replacing the faulty control means with a working replacement control means or recovering the faulty control means to working order; in which the system also comprises means for providing from a further control means to the replacement or recovered control means on replacement or recovery information on the allocation of the resources of the media path.