Abstract: Techniques for reduction and acceleration of a deterministic finite automaton (DFA) are disclosed. In some embodiments, a system, process, and/or computer program product for reduction and acceleration of a DFA includes receiving an input value; performing a reduced deterministic finite automaton lookup using a lookup key, wherein the lookup key comprises a current state and the input value; and determining a next state based on the lookup key.

Abstract: Techniques for reduction and acceleration of a deterministic finite automaton (DFA) are disclosed. In some embodiments, a system, process, and/or computer program product for reduction and acceleration of a DFA includes receiving an input value; performing a reduced deterministic finite automaton lookup using a lookup key, wherein the lookup key comprises a current state and the input value; and determining a next state based on the lookup key.

Abstract: Techniques for reduction and acceleration of a deterministic finite automaton (DFA) are disclosed. In some embodiments, a system, process, and/or computer program product for reduction and acceleration of a DFA includes receiving an input value; performing a reduced deterministic finite automaton lookup using a lookup key, wherein the lookup key comprises a current state and the input value; and determining a next state based on the lookup key.

Abstract: To use larger capacity TCAMs while avoiding various packaging and power management issues of TCAMs, pre-processing can be performed on TCAM lookup requests to intelligently pipeline lookup requests according to a defined power budget that is based on TCAM and power supply specifications. Dividing lookup requests based on a power budget smooths the instantaneous current demand and dynamic power demand. This intelligent pre-processing of lookup requests allows lookup requests that satisfy a power budget based threshold to still complete within a single clock cycle while nominally reducing performance for those lookup requests that would not satisfy the power budget based threshold. When a lookup request will not satisfy the power budget based threshold, the lookup request is split into searches targeting different memory blocks of the TCAM.

Abstract: Techniques for reduction and acceleration of a deterministic finite automaton (DFA) are disclosed. In some embodiments, a system, process, and/or computer program product for reduction and acceleration of a DFA includes receiving an input value; performing a reduced deterministic finite automaton lookup using a lookup key, wherein the lookup key comprises a current state and the input value; and determining a next state based on the lookup key.

Abstract: To use larger capacity TCAMs while avoiding various packaging and power management issues of TCAMs, pre-processing can be performed on TCAM lookup requests to intelligently pipeline lookup requests according to a defined power budget that is based on TCAM and power supply specifications. Dividing lookup requests based on a power budget smooths the instantaneous current demand and dynamic power demand. This intelligent pre-processing of lookup requests allows lookup requests that satisfy a power budget based threshold to still complete within a single clock cycle while nominally reducing performance for those lookup requests that would not satisfy the power budget based threshold. When a lookup request will not satisfy the power budget based threshold, the lookup request is split into searches targeting different memory blocks of the TCAM.

Abstract: Techniques for reduction and acceleration of a deterministic finite automaton (DFA) are disclosed. In some embodiments, a system, process, and/or computer program product for reduction and acceleration of a DFA includes receiving an input value; performing a reduced deterministic finite automaton lookup using a lookup key, wherein the lookup key comprises a current state and the input value; and determining a next state based on the lookup key.

Abstract: To use larger capacity TCAMs while avoiding various packaging and power management issues of TCAMs, pre-processing can be performed on TCAM lookup requests to intelligently pipeline lookup requests according to a defined power budget that is based on TCAM and power supply specifications. Dividing lookup requests based on a power budget smooths the instantaneous current demand and dynamic power demand. This intelligent pre-processing of lookup requests allows lookup requests that satisfy a power budget based threshold to still complete within a single clock cycle while nominally reducing performance for those lookup requests that would not satisfy the power budget based threshold. When a lookup request will not satisfy the power budget based threshold, the lookup request is split into searches targeting different memory blocks of the TCAM.

Abstract: Techniques for reduction and acceleration of a deterministic finite automaton (DFA) are disclosed. In some embodiments, a system, process, and/or computer program product for reduction and acceleration of a DFA includes receiving an input value; performing a reduced deterministic finite automaton lookup using a lookup key, wherein the lookup key comprises a current state and the input value; and determining a next state based on the lookup key.

Abstract: Techniques for reduction and acceleration of a deterministic finite automaton (DFA) are disclosed. In some embodiments, a system, process, and/or computer program product for reduction and acceleration of a DFA includes receiving an input value; performing a reduced deterministic finite automaton lookup using a lookup key, wherein the lookup key comprises a current state and the input value; and determining a next state based on the lookup key.

Abstract: A network security device includes a network flow statistics processing engine to process network flow information related to network flows. The network flow statistics processing engine includes a first processing stage performing per-flow information aggregation and a second processing stage performing per-destination system component information aggregation, with each processing stage implementing a threshold-based data export scheme and a timer-based data export scheme. In this manner, up-to-date flow information is available to peer system components regardless of the varying flow rates of the network flow.

Abstract: A network security device includes a network flow statistics processing engine to process network flow information related to network flows. The network flow statistics processing engine includes a first processing stage performing per-flow information aggregation and a second processing stage performing per-destination system component information aggregation, with each processing stage implementing a threshold-based data export scheme and a timer-based data export scheme. In this manner, up-to-date flow information is available to peer system components regardless of the varying flow rates of the network flow.

Abstract: A network security device includes a network flow statistics processing engine to process network flow information related to network flows. The network flow statistics processing engine includes a first processing stage performing per-flow information aggregation and a second processing stage performing per-destination system component information aggregation, with each processing stage implementing a threshold-based data export scheme and a timer-based data export scheme. In this manner, up-to-date flow information is available to peer system components regardless of the varying flow rates of the network flow.

Abstract: First, a packet may be received and a timestamp value may be placed on the packet. The timestamp value may comprise a place time value comprising a time when the timestamp was placed on the packet plus a delay time value comprising an estimated time delay between when the timestamp was placed on the packet and when the packet leaves a port exit. Next, the packet may be sent to a first in first out (FIFO) memory. The packet may then be sent from the FIFO memory out the port exit.

Abstract: First, a packet may be received and a timestamp value may be placed on the packet. The timestamp value may comprise a place time value comprising a time when the timestamp was placed on the packet plus a delay time value comprising an estimated time delay between when the timestamp was placed on the packet and when the packet leaves a port exit. Next, the packet may be sent to a first in first out (FIFO) memory. The packet may then be sent from the FIFO memory out the port exit.