Abstract: A network device may receive a packet and may determine whether a next header of the packet is an Internet protocol (IP) header, an Internet control message protocol (ICMP) header, or a segment routing header. The network device may determine, when the next header of the packet is the IP header, whether policy processing of the packet is set to ultimate segment decapsulation and may discard the packet when the policy processing of the packet is not set to ultimate segment decapsulation. The network device may decapsulate an outer header of the packet when the policy processing of the packet is set to ultimate segment decapsulation and may process the packet after decapsulating the outer header of the packet, to generate a processed packet. The network device may forward the processed packet toward a destination.

Abstract: A load balancing component may obtain, from a plurality of packet forwarding components of the network device, indications of load balancing metrics associated with a plurality of communication links that the plurality of packet forwarding components use to forward packet data. The load balancing component may determine, based on the load balancing metrics, aggregate load balancing metrics associated with respective communication links of the plurality of communication links. The load balancing component may identify an imbalance in load balancing metrics. The load balancing component may determine, based on the imbalance, a load balancing schedule that indicates traffic distributions for the plurality of packet forwarding components. The load balancing component may provide indications of the traffic distributions to the plurality of packet forwarding components to permit the plurality of packet forwarding components to forward packet data based on the indications of the traffic distributions.

Abstract: A method may include (1) identifying a set of prefixes that (A) facilitate forwarding traffic within a network and (B) are organized as a tree data structure in connection with a table stored on a network device, (2) identifying, in the set of prefixes organized as the tree data structure, a parent prefix and a child prefix that corresponds to the parent prefix, (3) determining that the parent prefix and the child prefix share a certain number of most-significant bits in common with one another, (4) determining that the parent prefix and the child prefix share a forwarding behavior in common with one another and then, in response to determining that the parent prefix and the child prefix share the certain number of most-significant bits and the forwarding behavior in common with one another, (5) compressing the table stored on the network device by merging the child prefix with the parent prefix within the table. Various other apparatuses, systems, and methods are also disclosed.

Abstract: This disclosure describes techniques that include determining, at an egress node in an SRm6 network, how to process a packet that may arrive without a segment routing header and/or a compressed routing header. In one example, this disclosure describes a method that includes receiving, by an egress node of a segment routing network, segment routing advertisements; configuring, by the egress node and based on the segment routing advertisements, information enabling the egress node to recognize encapsulated packets arriving at the egress node without a compressed routing header; receiving, by the egress node, a packet that does not have a compressed routing header; and de-encapsulating, by the egress node and based on the stored information, the packet.

Abstract: A network device may receive, from a first network, a network packet of a first network packet type that encapsulates a fragment of a second network packet of a second network packet type, where the network packet includes an extension header that indicates a source port and a destination port for the second network packet. The network device may perform an anti-spoof check on the fragment of the second network packet based at least in part on at least one of: the source port or the destination port for the second network packet that is indicated by the extension header. The network device may, based on the fragment passing the anti-spoof check, forward the fragment of the second network packet to a second network.

Abstract: An example first network device includes a control unit configured to execute at least one application and a forwarding unit. The forwarding unit includes an interface configured to receive packets, at least one packet processor operably coupled to a memory, and a forwarding path, wherein at least a portion of the forwarding path is stored in the memory and is executable by the at least one packet processor. The forwarding unit is configured to receive an advertisement originated by a second network device in a network, wherein the advertisement specifies a second micro segment identifier (SID), and store, in a destination lookup table, a route entry comprising a first micro SID associated with the first network device and the second micro SID.

Abstract: This disclosure describes techniques for using Operations, Administration, and Management (OAM) operations when routing packets using micro SIDs in segment routing. For example, a network device comprises one or more processors configured to: receive a packet; determine whether the packet is encapsulated with one or more micro segment identifiers (SIDs); in response to a determination that the packet is not encapsulated with one or more micro SIDs, determine whether the packet has reached a segment routing tunnel endpoint; and in response to a determination that the packet has reached the segment routing tunnel endpoint, initiate Operations, Administration, and Maintenance (OAM).

Abstract: This disclosure describes techniques that include determining, at an egress node in an SRm6 network, how to process a packet that may arrive without a segment routing header and/or a compressed routing header. In one example, this disclosure describes a method that includes receiving, by an egress node of a segment routing network, segment routing advertisements; configuring, by the egress node and based on the segment routing advertisements, information enabling the egress node to recognize encapsulated packets arriving at the egress node without a compressed routing header; receiving, by the egress node, a packet that does not have a compressed routing header; and de-encapsulating, by the egress node and based on the stored information, the packet.

Abstract: In one example, a method comprises generating, by a forwarding manager for an internal forwarding path executed by a plurality of packet processors of a forwarding unit of a network device, a dependencies structure that specifies one or more dependencies for a plurality of nodes, wherein the plurality of nodes represent different types of forwarding path elements of the forwarding path, wherein the plurality of nodes is binded to a first set of one or more packet processors of the plurality of packet processors; and rebinding, by the forwarding manager, a second set of one or more packet processors of the plurality of packet processors to the plurality of nodes, wherein rebinding the second set of one or more packet processors to the plurality of nodes is performed in a reverse direction of the dependencies structure.

Abstract: A load balancing component may obtain, from a plurality of packet forwarding components of the network device, indications of load balancing metrics associated with a plurality of communication links that the plurality of packet forwarding components use to forward packet data. The load balancing component may determine, based on the load balancing metrics, aggregate load balancing metrics associated with respective communication links of the plurality of communication links. The load balancing component may identify an imbalance in load balancing metrics. The load balancing component may determine, based on the imbalance, a load balancing schedule that indicates traffic distributions for the plurality of packet forwarding components. The load balancing component may provide indications of the traffic distributions to the plurality of packet forwarding components to permit the plurality of packet forwarding components to forward packet data based on the indications of the traffic distributions.

Abstract: In one example, a method comprises receiving, by a forwarding manager for an internal forwarding path executed by at least one packet processor of a forwarding unit of a network device, one or more packet processing operations from a control unit of the network device; generating, by the forwarding manager based on the one or more packet processing operations, a plurality of nodes each comprising a unique token, wherein a first node of the plurality of nodes includes a token reference set to a value for the token of a second node of the plurality of nodes; configuring, by the forwarding manager based on the nodes, the forwarding path to include respective forwarding path elements for the plurality of nodes; and processing, by the packet processor, a packet received by the forwarding unit by executing the forwarding path elements.

Abstract: In one example, a method comprises receiving, by a forwarding manager for an internal forwarding path executed by at least one packet processor of a forwarding unit of a network device, one or more packet processing operations from a control unit of the network device; generating, by the forwarding manager based on the one or more packet processing operations, a plurality of nodes each comprising a unique token, wherein a first node of the plurality of nodes includes a token reference set to a value for the token of a second node of the plurality of nodes; configuring, by the forwarding manager based on the nodes, the forwarding path to include respective forwarding path elements for the plurality of nodes; and processing, by the packet processor, a packet received by the forwarding unit by executing the forwarding path elements.

Abstract: An example network device includes a flow cache configured to store a flow cache entry that indicates a memory address referenced by one or more actions of the flow cache entry and a first learn index for the memory address, a memory address map configured to store a second learn index for the memory address, and one or more processors implemented in circuity. The network device is configured to receive a packet for the flow and obtain, from the flow cache entry for the flow, the memory address referenced by the one or more actions and the first learn index. The network device is further configured to determine the first learn index matches the second learn index and forward, in response to the determining, the packet using the one or more actions of the flow cache entry.

Abstract: In one example, a method includes detecting, by a forwarding manager for an internal forwarding path executed by at least one packet processor of a forwarding unit of a network device, that the at least one packet processor of a plurality of packet processors has become available for processing packets for forwarding; in response to the detecting, ceasing, by the forwarding manager, execution of control processing operations received from a control unit of the network device; and programming, by the forwarding manager, a plurality of forwarding path elements of the at least one packet processor based on a dependencies data structure, wherein the dependencies data structure comprises one or more dependencies that each indicates, for a node of a plurality of nodes, one or more nodes that reference the node, and wherein each node of the plurality of nodes corresponds to a single forwarding path element of the plurality of forwarding path elements.

Abstract: In one example, a method comprises receiving, by a forwarding manager for an internal forwarding path executed by at least one packet processor of a forwarding unit of a network device, one or more packet processing operations from a control unit of the network device; generating, by the forwarding manager based on the one or more packet processing operations, a plurality of nodes each comprising a unique token, wherein a first node of the plurality of nodes includes a token reference set to a value for the token of a second node of the plurality of nodes; configuring, by the forwarding manager based on the nodes, the forwarding path to include respective forwarding path elements for the plurality of nodes; and processing, by the packet processor, a packet received by the forwarding unit by executing the forwarding path elements.

Abstract: An example network device includes a flow cache configured to store a flow cache entry that indicates a memory address referenced by one or more actions of the flow cache entry and a first learn index for the memory address, a memory address map configured to store a second learn index for the memory address, and one or more processors implemented in circuity. The network device is configured to receive a packet for the flow and obtain, from the flow cache entry for the flow, the memory address referenced by the one or more actions and the first learn index. The network device is further configured to determine the first learn index matches the second learn index and forward, in response to the determining, the packet using the one or more actions of the flow cache entry.

Abstract: In one example, a method includes detecting, by a forwarding manager for an internal forwarding path executed by at least one packet processor of a forwarding unit of a network device, that the at least one packet processor of a plurality of packet processors has become available for processing packets for forwarding; in response to the detecting, ceasing, by the forwarding manager, execution of control processing operations received from a control unit of the network device; and programming, by the forwarding manager, a plurality of forwarding path elements of the at least one packet processor based on a dependencies data structure, wherein the dependencies data structure comprises one or more dependencies that each indicates, for a node of a plurality of nodes, one or more nodes that reference the node, and wherein each node of the plurality of nodes corresponds to a single forwarding path element of the plurality of forwarding path elements.

Abstract: In one example, a method comprises receiving, by a forwarding manager for an internal forwarding path executed by at least one packet processor of a forwarding unit of a network device, one or more packet processing operations from a control unit of the network device; generating, by the forwarding manager based on the one or more packet processing operations, a plurality of nodes each comprising a unique token, wherein a first node of the plurality of nodes includes a token reference set to a value for the token of a second node of the plurality of nodes; configuring, by the forwarding manager based on the nodes, the forwarding path to include respective forwarding path elements for the plurality of nodes; and processing, by the packet processor, a packet received by the forwarding unit by executing the forwarding path elements.

Abstract: Techniques are described to provide split-horizon packet forwarding so as to ensure that packets from the customer network that are injected into the provider backbone bridging Ethernet Virtual Private Network (PBB-EVPN) by one of the provider edge (PE) devices of the multi-homed Ethernet segment are not forwarded back toward the customer network by a different PE device connected to the same multi-homed Ethernet segment. For example, a method may comprise receiving a packet via a core-facing interface of a first PE device, determining the Ethernet segment associated with the PE devices by a lookup operation based on keys of the packet; in response to determining the Ethernet segment, supplanting the core-facing interface of the first PE device with a virtual interface associated with the keys, and forwarding the packet to a second CE device without forwarding the received packet back to the Ethernet segment associated with the first PE device.

Abstract: A system and method for selecting packets to be forwarded from redundant multicast streams. A primary multicast stream and a secondary multicast stream are received, wherein the primary multicast stream and the secondary multicast stream are redundant multicast streams received over disjoint multicast forwarding paths. A hardware-based analyzer in a forwarding plane of the network device is applied to detect when a quality of one of the primary multicast stream or the secondary multicast stream has fallen below a threshold. In response to detecting that a quality of one of the primary multicast stream or the secondary multicast stream has fallen below a threshold, selecting, via a thread executing in a forwarding component of the network device, a different one of the primary multicast stream or the secondary multicast stream having a quality that meets the threshold, wherein selecting includes dynamically rewriting next hop operations associated with the selected stream.