Abstract: Described embodiments include a system that includes one or more buffers and circuitry. The circuitry is configured to process a plurality of input values, by identifying each of the input values that is not zero-valued, and, for each value of the identified input values, computing respective products of coefficients of a kernel with the value and storing at least some of the respective products in the buffers. The circuitry is further configured to compute a plurality of output values, by retrieving respective sets of stored values from the buffers, at least some of the retrieved sets including one or more of the products, and summing the retrieved sets. The circuitry is further configured to output the computed output values. Other embodiments are also described.

Abstract: A credit loop that produces a deadlock is identified in a network of switches that are interconnected for packet traffic flows therethrough. The identification is carried out by periodically transmitting respective credit loop control messages from the loop-participating switches via their deadlock-suspected egress ports to respective next-hop switches. The CLCMs has switch port-unique identifiers (SPUIDs). The loop is identified when in one of the next-hop switches the SPUID of a received CLCM is equal to the SPUID of a transmitted CLCM thereof. A master switch is selected for resolving the deadlock.

Abstract: A network switch includes switch circuitry and multiple ports. The ports are configured to communicate with a communication network. The switch circuitry is configured to receive via the ports multiple packets, which are destined to a destination network node and which specify attributes used by the destination network node as cache keys for on-demand fetching of context items into a cache memory of the destination network node, to control a rate of fetching the context items into the cache memory at the destination network node, by ordering the received packets in a sequence, based on the attributes of the respective packets, using an ordering criterion that aims to place packets that access a common context item in proximity to one another in the sequence, and to forward the received packets to the destination network node, via the ports, in accordance with the ordered sequence.

Abstract: A network connection device having a security processor exchanges data traffic between a data network and a host computer via a network port. Security management data is exchanged exclusively between the security processor and a management network via a management network connectivity port that is inaccessible to the data traffic.

Abstract: A network switch includes switch circuitry and multiple ports. The ports are configured to communicate with a communication network. The switch circuitry is configured to receive via the ports multiple packets, which are destined to a destination network node and which specify attributes used by the destination network node as cache keys for on-demand fetching of context items into a cache memory of the destination network node, to control a rate of fetching the context items into the cache memory at the destination network node, by ordering the received packets in a sequence, based on the attributes of the respective packets, using an ordering criterion that aims to place packets that access a common context item in proximity to one another in the sequence, and to forward the received packets to the destination network node, via the ports, in accordance with the ordered sequence.

Abstract: A network connection device having a security processor exchanges data traffic between a data network and a host computer via a network port. Security management data is exchanged exclusively between the security processor and a management network via a management network connectivity port that is inaccessible to the data traffic.

Abstract: Described embodiments include a system that includes one or more buffers and circuitry. The circuitry is configured to process a plurality of input values, by identifying each of the input values that is not zero-valued, and, for each value of the identified input values, computing respective products of coefficients of a kernel with the value and storing at least some of the respective products in the buffers. The circuitry is further configured to compute a plurality of output values, by retrieving respective sets of stored values from the buffers, at least some of the retrieved sets including one or more of the products, and summing the retrieved sets. The circuitry is further configured to output the computed output values. Other embodiments are also described.

Abstract: A method for processing packets in a network device includes receiving a packet at the network device, identifying a flow with which the packet is associated, and, based at least in part on the identified flow, selectively causing the packet, or a packet descriptor associated with the packet, to bypass at least a first packet processing unit of the network device.

Abstract: A credit loop that produces a deadlock is identified in a network of switches that are interconnected for packet traffic flows therethrough. The identification is carried out by periodically transmitting respective credit loop control messages from the loop-participating switches via their deadlock-suspected egress ports to respective next-hop switches. The CLCMs has switch port-unique identifiers (SPUIDs). The loop is identified when in one of the next-hop switches the SPUID of a received CLCM is equal to the SPUID of a transmitted CLCM thereof. A master switch is selected for resolving the deadlock.

Abstract: A method for processing packets in a network device includes receiving a packet at the network device, identifying a flow with which the packet is associated, and, based at least in part on the identified flow, selectively causing the packet, or a packet descriptor associated with the packet, to bypass at least a first packet processing unit of the network device.

Abstract: In a method of determining whether a data stream includes unauthorized data, the data stream is analyzed using a hardware filter to detect a presence of one or more of a first set of patterns in the data stream. It is determined whether a packet in the data stream belongs to one of a plurality of data flows to be further inspected based on the analysis of the data stream by the hardware filter. A set of rules is applied to the packet to produce rule match status data if it is determined that the packet belongs to one of the plurality of data flows to be further inspected. The packet is analyzed to determine if the packet includes unauthorized data using software stored on a computer-readable medium and implemented on a processor if the rule match status data indicates that the packet potentially includes unauthorized data.

Abstract: An apparatus having a content-addressable memory (CAM) that stores a plurality of entries comprising portions of a plurality of patterns; a memory that stores a shift value corresponding to each of the entries; and a controller that generates a first key based on a received string, applies the first key to the CAM to select an entry of the CAM, retrieves the shift value from the memory corresponding to the selected entry, in response to the shift value being equal to a predetermined value, identifies an initial match, and in response to the initial match corresponding to a first pattern of the plurality of patterns that is larger than the entries of the CAM, applies adjacent keys based on the received string to the CAM, and declares a complete match when each of the corresponding shift values from the memory is equal to the predetermined value.

Abstract: A network apparatus comprises a plurality of ports, and a forwarding engine coupled to the plurality of ports. The forwarding engine is configured to transfer data units received via at least some of the plurality of ports to one or more appropriate ports in the plurality of ports. The forwarding engine comprises a content addressable memory (CAM) device to store a plurality of data patterns organized in a plurality of groups, wherein the CAM device is configured to, responsive to input data, output in a single cycle a plurality of match indications corresponding to the plurality of groups. The forwarding engine also comprises a logic device coupled to the CAM device and configured to generate an action value based on the plurality of match indications, wherein the action value indicates an action to be taken by the forwarding engine.

Abstract: A first sub-switch for a network switch includes a plurality of ports. A forwarding engine communicates with the ports. A control plane processor communicates with the forwarding engine. A first sub-switch interface communicates with the forwarding engine and receives a path message from a second sub-switch in the network switch. A second sub-switch interface communicates with the forwarding engine, transmits the path message to a third sub-switch in the network switch, and receives a reserve message from the third sub-switch identifying requested resources for a planned data flow having a quality of service. The control plane processor attempts to reserve the requested resources on the second sub-switch interface based on the quality of service.

Abstract: A search engine includes a storage module to store a plurality of data patterns, a plurality of busses to receive a plurality of representations of a search word, a selector corresponding to at least one of the plurality of data patterns to select one of the plurality of representations of the search word for comparing to the at least one of the plurality of data patterns, and a logic circuit operatively coupled to the storage module, to the plurality of busses, and to the selector to compare the selected one of the plurality of representations of the search word to the at least one of the plurality of data patterns.

Abstract: A method, apparatus, and computer-readable media for a network device comprises a plurality of ports to exchange packets of data with one or more networks according to Quality of Service parameters configured for each of the ports; a forwarding engine to forward the packets of data between the ports; and a control plane processor to identify one or more planned data flows through the network device between the ports; wherein the control plane processor identifies associations between each of the planned data flows and one of a plurality of services for the planned data flows; and wherein the network device automatically configures the Quality of Service parameters of the ports according to the services and the associations between the planned data flows and the services.

Abstract: A methods, apparatus and computer memory are provided for packet scheduling. A processor polls queues in a round robin fashion and schedules for transmission onto a link a packet in each queue with no deficit before scheduling for transmission onto the link a packet in each queue with a deficit. A credit is allocated to each queue with the deficit based on a proportional weight, until each queue with the deficit has a credit.

Abstract: Apparatus having corresponding methods and computer programs, to detect a pattern in a string, comprises a memory circuit to store W-character segments of the pattern, where each segment comprises a fragment of the pattern; a key circuit to generate W-character keys each including a fragment of the string; a comparison circuit to compare the keys and the segments; where, when a segment matches a key, the comparison circuit indicates an initial match between the pattern and the string; and where, when one of the segments matches only a L-character fragment of one of the keys, wherein L<W, the key circuit generates a new key including the L-character fragment and a K-character fragment of the string including K=W?L consecutive characters from the string that are adjacent to the L matching characters in the string.

Abstract: A method for identifying and prioritizing iSCSI traffic in an IP network. At least one iSCSI-aware switch which receives information identifying an iSCSI session, e.g., its iSCSI target port or IP address, may multicast such identifying information to let a second iSCSI-aware switch in the IP network know the information about the iSCSI session. The second iSCSI-aware switch may update its memory, software and hardware, so as to track the iSCSI session when the iSCSI session passes through it and give it priority over other network traffic.

Abstract: An apparatus, method and computer memory for electing a master unit from multiple candidate units on a ring or chain topology network is provided. Master proposal data packets are transmitted onto a plurality of stacking links. At least one message data packet is received on the one candidate unit. A candidate unit is elected as the master unit if it receives message data packets corresponding to the transmitted master proposal data packets.