Abstract: In one embodiment an approach is provided to efficiently program routes on line cards and fabric modules in a modular router to avoid hot spots and thus avoid undesirable packet loss. Each fabric module includes two separate processors or application specific integrated circuits (ASICs). In another embodiment, each fabric module processor is replaced by a pair of fabric module processors arranged in series with each other, and each processor is responsible for routing only, e.g., IPv4 or IPv6 traffic. The pair of fabric module processors communicates with one another via a trunk line and any packet received at either one of the pair is passed to the other of the pair before being passed back to a line card.

Abstract: A method of identifying a device includes receiving a device transaction request from a remote device, receiving a first device fingerprint of the remote device, and receiving a second device fingerprint of a known device. The first device fingerprint is compared with the second device fingerprint and a first metric indicative of a similarity of the first device fingerprint and the second device fingerprint is generated. A third device fingerprint corresponding to an expected current value of the second device fingerprint is generated, and the first device fingerprint is compared with the third device fingerprint to generate a second metric indicative of a similarity of the first device fingerprint and the third device fingerprint. A response to the transaction request is formulated based on the first metric and the second metric.

Abstract: Systems, methods, and computer-readable storage media for detecting network loops. A system can identify, for each virtual tunnel endpoint (VTEP) from multiple VTEPs in a network, respective media access control address data including the respective local interface media access control addresses of the respective VTEP and respective media access control addresses learned by the respective VTEP. The system can determine whether the VTEPs are running spanning tree protocol (STP), and whether a media access control address learned by a first VTEP matches a respective local interface media access control address of a second VTEP. The system can detect a loop when the media access control address learned by the first VTEP matches the respective local interface media access control address of the second VTEP. The system can also detect a loop when the VTEPs are running STP and the first and second VTEPs see the same STP root bridge.

Abstract: Systems, methods, and non-transitory computer-readable storage media for detecting network loops. In some embodiments, a system can identify a port that is in a blocking state. The blocking state can be for dropping one or more types of packets and preventing the port from forwarding the one or more types of packets. The system can determine a number of packets transmitted through the port by a hardware layer on the system and a number of control packets transmitted through the port by a software layer on the system. The system can determine whether the number of packets is greater than the number of control packets. When the number of packets is greater than the number of control packets, the system can determine that the blocking state has failed to prevent the port from forwarding the one or more types of packets.

Abstract: Systems, methods, and computer-readable media for preventing man-in-the-middle attacks within network, without the need to maintain trusted/un-trusted port listings on each network device. The solutions disclosed herein leverage a host database which can be present on controllers, thereby providing a centralized database instead of a per-node DHCP binding database. Systems configured according to this disclosure (1) use a flood list only for ARP packets received from the controller 116; and (2) unicast ARP packets to the controller before communicating the packets to other VTEPs.

Abstract: Systems, methods, and non-transitory computer-readable storage media for detecting network loops. In some embodiments, a system can identify a network path having multiple hops associated with respective nodes which are configured in a forwarding mode. The system can traverse the network path to identify, for each node from the respective nodes, a respective next hop. Based on the respective next hop for each node, the system can determine whether two or more nodes from the respective nodes have a same respective next hop. When the two or more nodes have the same respective next hop, the system can determine that the network path has a network loop.

Abstract: Mechanisms for switch upgrades using remote containers. An example system can export, to a server, a state of software processes associated with a first software container at the system. The system can generate a lightweight software container configured to forward traffic associated with the first software container to a second software container at the server, generated based on the state. The system can perform a switchover between the first software container and lightweight software container. The switchover can enable the lightweight software container to forward, to the second container, traffic associated with the first software container. The system can generate a fourth software container based on a snapshot of the second software container, and perform another switchover between the lightweight software container and fourth software container.

Abstract: Mechanisms for switch upgrades using remote containers. An example system can export, to a server, a state of software processes associated with a first software container at the system. The system can generate a lightweight software container configured to forward traffic associated with the first software container to a second software container at the server, generated based on the state. The system can perform a switchover between the first software container and lightweight software container. The switchover can enable the lightweight software container to forward, to the second container, traffic associated with the first software container. The system can generate a fourth software container based on a snapshot of the second software container, and perform another switchover between the lightweight software container and fourth software container.

Abstract: Aspects of the present disclosure are directed to dynamically adjusting control plane policing throughput of low (or lower) priority control plane traffic to permit higher throughput. The drop rate for low or lower priority control plane traffic can be determined to be above a threshold value. The processor utilization can be determined to be operating under normal utilization (or at a utilization within a threshold utilization value). The control plane policing for control plane traffic for the low or lower class of service can be increased (or decreased) to permit lower class of service control traffic to be transmitted using higher class of service resources without adjusting the priority levels for the lower class of service control traffic.

Abstract: System and method of dynamically adjusting a frame buffer resolution. An average frame rate is dynamically computed based on the frame rates with respect to rendering a sequence of previous frames to a frame buffer. The frame rates may vary with the processing load of an associated graphics processor. A target scaling factor for frame buffer resolution is computed based upon the dynamic average frame rate and a desired frame rate. The current scaling factor of frame buffer resolution for rendering a respective frame data of a sequence of frame data to the frame buffer is adjusted incrementally to reach the target scaling factor. Accordingly, frame resolutions for rendering the sequence of frame data to the frame buffer are incrementally adjusted based on corresponding current scaling factors.

Abstract: In one embodiment an approach is provided to efficiently program routes on line cards and fabric modules in a modular router to avoid hot spots and thus avoid undesirable packet loss. Each fabric module includes two separate processors or application specific integrated circuits (ASICs). In another embodiment, each fabric module processor is replaced by a pair of fabric module processors arranged in series with each other, and each processor is responsible for routing only, e.g., IPv4 or IPv6 traffic. The pair of fabric module processors communicates with one another via a trunk line and any packet received at either one of the pair is passed to the other of the pair before being passed back to a line card.

Abstract: A method of identifying a device includes receiving a device transaction request from a remote device, receiving a first device fingerprint of the remote device, and receiving a second device fingerprint of a known device. The first device fingerprint is compared with the second device fingerprint and a first metric indicative of a similarity of the first device fingerprint and the second device fingerprint is generated. A third device fingerprint corresponding to an expected current value of the second device fingerprint is generated, and the first device fingerprint is compared with the third device fingerprint to generate a second metric indicative of a similarity of the first device fingerprint and the third device fingerprint. A response to the transaction request is formulated based on the first metric and the second metric.

Abstract: A method for dynamically adjusting a frame buffer resolution, the method comprising calculating a target scaling factor based upon a calculated average frame rate and incrementally changing a current scaling factor to reach the target scaling factor. The method includes calculating the target scaling factor based upon the average frame rate and a current scaling factor. The method includes adjusting a resolution of a frame of data rendered to the frame buffer according to the current scaling factor.