Broadcom Corporation

Pluris, Inc.

Fusion-io, Inc.

Aprius, Inc.

Avago Technologies International Sales Pte. Limited

Bora Akyol

Puneet Agarwal

Les Ginsberg

Daniel Talayco

Ali Ekici

Mark Leonard Buer

Mohan V Kalkunte

Yongbum Kim

Uri Elzur

Zheng Qi

Russell R Tuck, Iii

Brian R Baird

Venkateshwar Buduma

Erol Basturk

Sundara Murugan

Ford Tamer

Mike Mussoline

Venu Gopal Navar

Embodiments provide load balancing in a virtual computing environment comprising a plurality of PCI-Express switches (the PCIe switching cloud) coupled to a plurality of network interface devices (NICs). An NIC cluster is added between the PCIe switching cloud and the NICs. The NIC cluster is configured to hide NICs from system images and allow the system images to access functions across multiple NICs. The NIC cluster of an embodiment dynamically load balances network resources by performing a hashing function on a header field of received packets. The NIC cluster of an embodiment performs load balancing and state management in association with driver software, which is embedded in the system image. The driver software adds a tag for flow identification to downstream data packets. The NIC cluster distributes data packets based on information in the tag.

PCI express load sharing network interface controller cluster

A network interface device includes a security database and a security services engine. The security database is configured to store patterns corresponding to predetermined malware. The security services engine is configured to compare data to be transmitted through a network to the patterns stored in the security database, and the security database is configured to receive updated patterns from the network.

Intelligent network interface controller

Aspects of a method and system for controlling network access on a per-flow basis may comprise controlling access to a network by regulating at least one flow comprising one or more ingress packets based on a flow identifier associated with said one or more packets and based on an establishment of flows in said network. The flow identifier may comprise a source IP address, a destination IP address, a source MAC address, a destination MAC address, a network protocol, a source port number, and/or a destination port number. The number of flows permitted for a source and/or a rate at which a source is allowed to establish new flows may be limited. Flows that exceed one or more of these limits may be marked for further processing. Access to the network for the marked flows may be determined based on past and/or present network statistics. Flows received when a node is at capacity may also be marked for processing.

Method and system for controlling network access on a per-flow basis

Aspects of a method and system for securing a network utilizing IPsec and MACsec protocols are provided. In one or more network nodes, aspects of the invention may enable conversion between Ethernet packets comprising payloads secured utilizing IPsec protocols and Ethernet packets secured utilizing MACsec protocols. For example, IPsec connections may be terminated at an ingress network node and IPsec connections may be regenerated at an egress network node. Packets secured utilizing MACsec protocols may be detected based on an Ethertype. Packets comprising payloads secured utilizing IPsec protocols may be detected based on a protocol field or a next header field. The conversion may be based on a data structure stored by and/or accessible to the network nodes. Aspects of the invention may enable securing data utilizing MACsec protocols when tunneling IPsec secured data through non-IPsec enabled nodes.

Method and system for securing a network utilizing IPsec and MACsec protocols

Methods and systems for processing packets in data network using multistage classification are disclosed. An example method for processing packets includes receiving a data packet at a first processing stage and examining the packet at the first processing stage to determine a first attribute of the packet. Based on the first attribute, a first classification is assigned to the packet. In the example method, the packet and the first classification are communicated from the first processing stage to a second processing stage and the packet is examined at the second processing stage to determine a second attribute of the packet. Based on the second attribute, a second classification is assigned to the packet. The example method further includes processing the packet based on the first classification and the second classification.

Network packet processing using multi-stage classification

A universal routing identifier (URID) is provided to extend the function space in PCI-Express fabrics. Methods and systems based on the URID are provided for configuring URID capable devices and upgrading PCI-Express bridges and switches having lookup tables with access control functionality. The lookup table entry contains URIDs of destination ports, backup ports, acceptance ports, and permitted ports for downstream and upstream filtering, routing and arbitrating of transaction packets. URID capable devices can be incrementally added to current PCI-Express bridges and switches. A configuration mechanism is added to the current PCI/PCI-Express enumeration software. The URID capabilities can be disabled to maintain system compatibility. A URID capable PCI-Express system is able to address ten of thousands single-function devices. A URID capability segment field is provided in the current PCI-Express configuration space. Each URID capable device contains the URID capability segment implemented in its own set of configuration space registers.

Universal routing in PCI-Express fabrics

Aspects of a method and system for tunneling MACSec packets through non-MACSec-enabled nodes are provided. In this regard, aspects of the invention may be utilized for transmitting MACSec Ethernet packets over MACSec and/or non-MACSec-enabled network nodes. In one embodiment of the invention, additional header information may be inserted into a MACSec packet before transmitting the MACSec packet to a non-MACSec-enabled node. Accordingly, aspects of the invention may remove the additional header information from a packet received from a non-MACSec-enabled node to distinguish the packets comprising inserted additional header information, which may comprise a distinguishing Ethertype.

Method and system for tunneling MACSec packets through non-MACSec nodes

A distributed Link-State Routing Protocol (LSRP) system in a packet switch having external communication ports has a first card executing Update process of the LSRP, making database updates, a second card executing Decision process(Shortest Path First (SPF)) of the LSRP, and a communication fabric coupling the cards with each other and the external ports. The LSRP may be an IS-IS system. In some embodiments there are additional cards involved, and the distribution of Link-State functions is over a set of multiple cards. Also in some embodiments there is a Location Service (LS) controller monitoring and configuring cards in the system.

Scalable and fault-tolerant link state routing protocol for packet-switched networks

A method of and apparatus for distributing data for a database between a plurality of processors in a distributed processor system involves running a database management system on a first plurality of processors in conjunction with a plurality of protocols that generate or amend data for the database. Data is distributed from servers to clients registered in a server-client relationship. Server-client relationships may also be registered between a second, and a third plurality of processors that do not run protocols generating or amending data for the database. Fault tolerant redundancy is provided by clients registering with two or more servers, one as a primary and another as a secondary, and activating the secondary if the primary fails. The method is particularly applicable to scalable data packet routers having a plurality of processors operating on different line and control cards.

Methods and apparatus for synchronizing and propagating distributed routing databases

A method for providing fault-tolerance for Multi-Path Label Switching (MPLS) functionality in a multi-processor network routing node has the steps of (a) implementing an MPLS server application including state information, on a first and a second processor in the node; (b) designating the MPLS server on the first processor as a master server and the MPLS server on the second processor as a backup server, and providing MPLS functionality in the node with the master MPLS server; (c) directing all required MPLS events to both the master and the backup MPLS servers during operation; (d) monitoring operation of the master server; and (e) in the event of failure of the master server, designating the backup server as the master, allowing MPLS functions to continue on the routing node.

Fault-protection mechanism for protecting multi-protocol-label switching (MPLS) capability within a distributed processor router operating in an MPLS network

A distributed Link-State Routing Protocol (LSRP) system in a packet switch having external communication ports has a first card executing Update process of the LSRP, making database updates, a second card executing Decision process(Shortest Path First (SPF)) of the LSRP, and a communication fabric coupling the cards with each other and the external ports. The LSRP may be an IS&mdash;IS system. In some embodiments there are additional cards involved, and the distribution of Link-State functions is over a set of multiple cards. Also in some embodiments there is a Location Service (LS) controller monitoring and configuring cards in the system.

Growing community of inventors

San Jose, CA, United States of America

Bora Akyol