Abstract: Methods, apparatus, and other mechanisms are disclosed for merging lookup results, such as from one or more associative memory banks and/or memory devices. In one exemplary implementation, multiple associative memories or associative memory banks are configured to substantially simultaneously generate a plurality of lookup results based on a lookup value. Multiple memories are each configured to generate a corresponding result based on the lookup result generated by its corresponding associative memory or associative memory bank. A combiner is configured to receive and merge these corresponding results generated substantially simultaneously in order to identify the merged lookup result.

Abstract: Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms, for policy-based processing of packets, including mechanisms for managing the policies. A user is authenticated and its user group identifier is identified. A packet is received and is associated with the user group identifier, and one or more fields (typically other than the source address field) of the packet are used to identify a second group identifier. A lookup operation is then performed on a policy based on the first and second group identifiers to identify a packet processing action to be performed on the packet. These identifiers are typically not network addresses, which disassociates the policy from physical network addresses (which often are dynamically assigned and may also vary based on the access point into the network of a user), and allows a switching device to process packets based on a policy stated using group identifiers.

Abstract: Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms for limiting unauthorized multicast sources. One or more access control lists are typically configured in a switching device to a state that denies forwarding of multicast packets with a particular host as its source. In response to a received multicast application admission-control message identifying the particular host, the one or more access control lists in the switching device are updated to allow multicast messages sent from the particular host to be forwarded. In one system, the received multicast application admission-control message is an Internet Group Management Protocol (IGMP) message.

Abstract: An associative memory with an invert result capability to allow the identification of an entry as being matched when an entry or portion thereof is specifically not matched is disclosed (or alternatively viewed as an entry or portion thereof indicated as matched when it actually was not matched). One such associative memory typically includes multiple associative memory entries, each of which typically includes storage for one or more subsets of bits to be used in matching a lookup value and for one or more invert result indications to identify whether or not corresponding particular subsets of the one or more subsets of bits are to be inverted in producing an entry match result.

Abstract: Methods and apparatus are disclosed for performing lookup operations using associative memories, including, but not limited to modifying search keys within an associative memory based on modification mappings, forcing a no-hit condition in response to a highest-priority matching entry including a force no-hit indication, selecting among various sets or banks of associative memory entries in determining a lookup result, and detecting and propagating error conditions. In one implementation, each block retrieves a modification mapping from a local memory and modifies a received search key based on the mapping and received modification data. In one implementation, each of the associative memory entries includes a field for indicating that a successful match on the entry should or should not force a no-hit result. In one implementation, an indication of which associative memory blocks or sets of entries to use in a particular lookup operation is retrieved from a memory.

Abstract: Different mechanisms are disclosed for translating native Media Access Control (MAC) addresses to and from corresponding hierarchical MAC addresses, and the use of such MAC addresses. A packet switch typically maintains a data structure relating native MAC addresses of certain devices with external MAC addresses, wherein each of the external MAC addresses is typically hierarchical in nature with a portion of the translated address identifying a switch local to the destination device and through which the destination device is to be reached. Other network elements can then readily determine where to route a packet with a destination identified by such a hierarchical MAC address without having to maintain such a large or complete database of MAC addresses as the packet can be routed to the switch based on a portion of the hierarchical address (e.g., typically without regard to the portion of the address identifying the actual destination device).

Abstract: A data center topology routes traffic between internal sub-nets and between a sub-net and an outside network through a common chain of services. The data center topology employs transparent layer 7 and layer 4 services on a common chassis or platform to provide routing, load balancing and firewall services while reducing the number of devices necessary to implement the data center and simplifying configuration.