Cisco Technology, Inc.

Anbu Chezhian Gunalan

John H W Bettink

Ramanathan Lakshmikanthan

Jose Antonio Liste

Christian Schmutzer

Alok Khambatkone

Wanli Wu

Shishir Gupta

Annu Singh

Kuai Yu

SushilKumar G Jhawar

In an embodiment, a method includes receiving a data packet and generating an optimized security tag based on a standard security tag by replacing an 8-byte optional secure channel identifier (SCI) of the standard security tag with 32 most significant bits of a 4 packet number, a 2-byte MAC Security Entities (SecY) engine identifier, and a 2-byte short SCI. The method further includes encrypting the data packet and transmitting the encrypted data packet comprising the optimized security tag to an electronic device.

System and method for multi-PHY based MACsec over secure tunnels

In one embodiment, a method includes generating a subgraph from a dependency graph. The subgraph includes one or more potential paths between an event interest node and an event generator node of the dependency graph. The method also includes activating the event interest node and assigning, in response to activating the event interest node, a color to nodes along the one or more potential paths of the subgraph from the event interest node to the event generator node. The method further includes modifying the event generator node and modifying, in response to modifying the event generator node, one or more of the nodes along the one or more potential paths of the subgraph from the event generator node to the event interest node.

Systems and methods for assigning colors to nodes of a subgraph

A method for managing routing tables and data packet forwarding is disclosed. The method comprises obtaining, at a networking device, a first outgoing label associated with one or more output port identifiers of the networking device. The first outgoing label identifies a first destination node. The one or more output port identifiers identify one or more of a plurality of output ports. The method further comprises determining whether or not the one or more output port identifiers are also associated with a second outgoing label. The second outgoing label identifies a second destination node different from the first destination node. The method further comprises merging, into a next hop table allocated in a non-transitory memory, the first outgoing label with the second outgoing label in response to determining that the one or more output port identifiers are also associated with the second outgoing label.

Managing routing tables

In one embodiment, configurable policy-based processing of packets is performed, including, but not limited to, using user-configurable parameters to adjust control-plane allocation of resources used in processing of packets. In one embodiment, these resources include, but are not limited to, processing by fast path or slow path forwarding of packets; forwarding information base (FIB) entries, databases, and hardware processing elements; instantiation of sub-FIB databases; and/or selection of sub-FIB data plane entries for population of sub-FIB databases, a group of FIB entries is label switched traffic, fully expanded Internet Protocol routes, loopback addresses of packet switching devices in the network, label-switched to label-switched traffic, Internet Protocol (IP) to label-switched traffic, IP to IP traffic, and/or label to IP traffic. In one embodiment, a group of the plurality of different groups of FIB entries is defined upon how a route or label corresponding to a FIB entry was learned.

Adjusting control-plane allocation of packet processing resources

In one embodiment, packet streams are reliably transported through a network using packet replication. A packet stream is received at a duplication point in a network, with two or more copies of each of the packet streams being transported, typically over divergent paths in the network, to a merge point from which a single copy of the packet stream is forwarded or consumed. In one embodiment, this merge point is a packet switching device that includes ingress card(s) and egress line card(s), wherein multiple copies of the packet stream are received by ingress line card(s), with only a single copy provided to an egress line card of the packet switching device. In this manner, a switching fabric or other communication mechanism communicatively coupling the ingress line card(s) to the egress line card, nor the egress line card, is taxed with the burden imposed by additional copies of packet stream.

Growing community of inventors

San Jose, CA, United States of America

Anbu Chezhian Gunalan