3com Corporation

Hewlett-packard Development Company, L.p.

Hewlett-packard Company

3com Technologies

Daniel M O'Keeffe

Kevin Loughran

David J Law

Eugene O'Neill

Edele O'Malley

Justin A Drummond-Murray

Mark A Hughes

Paul J Moran

Kam Choi

Peter Furlong

Robin Parry

Eoghan Stack

Eoin O'Brien

Neil J Clifford

John F Hickey

Christopher Alan Walker

Joseph N Butler

Michael Joseph Gleeson

Christopher Byham

Paul O'Keeffe

Annette E Sohor

Paul Flood

The occurrence of false positives and the post-processing of digital streams subjected to examination by a deterministic finite state machine for character strings are reduced by combining location-based pattern matching, e.g. on packet headers, and content-based pattern matching, e.g. on payloads of packets. One scheme allows automatic transition from a header match state into an initial state of a content matching machine. Another scheme is based on a rules graph defining strings of match states and the examination of a list of match states (rather than characters) which have been previously determined, for example by means of header matching and content matching. The latter is also capable of comparing offset and depth values associated with the match states with offset and depth criteria.

Signature checking using deterministic finite state machines

A cascade system of network units includes forwarding units which have external ports, a communication fabric connecting the units and at least one processing unit which needs no forwarding database. The processing unit may perform a security operation such as intrusion prevention or encryption. Each forwarding unit on receipt of a packet performs a look-up to determine an egress port, to determine whether the packet must be diverted to a processing unit, to provide the packet with a first forwarding instruction identifying the egress port uniquely within the system and a second forwarding instruction identifying a diversion port by which the packet can reach the processing unit and to set an order field which determines which of the forwarding instructions shall be performed first. The processing unit is operative on receipt of the packet by way of the diversion port to change the order field to specify that the packet should now be sent to the egress port.

Packet diversion in switching fabrics and multiple forwarding instructions for packets

A method of detecting signatures in message segments comprises employing a state machine for the detection of character strings in the message segments. The state machine executes for each input character a transition determined by a current state of the machine and a current input character. The message segments conform to TCP or other ordering transport protocol. The order of arrival of the message segments is monitored. In the event that an intermediate message segment is missing between a processed segment and an immediately subsequent message segment, the current state of said state machine at the end of the said processed segment is stored. The machine is restarted from its null or datum state for the examination of the immediately subsequent message segment, which is then temporarily stored. When the missing segment eventually arrives, it and the stored segment are successively examined for signatures by means of the state machine, beginning at the stored state. The invention allows for examination of overlapping signatures without requiring re-assembly of the segments or substantial buffering.

Detection of signatures in disordered message segments

A content addressable memory stores entries each comprising a rule and as part of the entry a mask identifying all the entities to which the rule is applicable. A search pattern of data and a bit mask identifying the actual entity (or entities) associated with the data is applied as a search word along with a comparison mask that excludes all the other entities from the comparison of the search word with the entry. The CAM can thereby store efficiently in a single entry a rule that may be applicable to some but not all of a multiplicity of entities such as possible ingress ports of a network unit.

Content addressable memory organized to share entries between different entities such as ports of a network unit

A rules engine for the examination of selected fields in an addressed data packet has an access control list table of which the entries each define an access control list rule, an action and a chain identifier. The access control list rule may be a basic rule which refers to network addresses and transport layer port numbers. The rules engine also has an extension rule table of which the entries each define an extension rule, a respective action and a respective rule identifier. The extension rule may refer to a particular TCP flag. When a packet arrives, the engine searches both tables. This search is made independently of the ordinary network layer or link layer address lookup. If there is a match in both tables, and the chain identifier matches the extension rule identifier, the rules engine prescribes the action associated with the extension rule. If the chain identifier of a matched access control list rule does not match a rule identifier of a matched extension rule the rules engine prescribes the action associated with the basic rule. In the absence of a match with any access control list rule the action on a packet is based on the result from the ordinary address lookup.

Rules engine for access control lists in network units

A method and switch for controlling the allocation of priority of TCP packets, more particularly for distinguishing between data and control packets and assigning an increased priority to control packets. The layer 4 information in the form of the flag bits of the header are snooped in the switch to determine whether any flag other than PSH is set and if so to allocate a priority to that packet, which will usually be a higher priority than data packets.

TCP control packet differential service

For each metered flow in a network unit there is a memory entry which defines a time stamp and a rate parameter. When a packet in the respective flow arrives, the time of arrival is compared with the time stamp. If the time of arrival is before the time stamp the packet is discarded. If the packet arrives after the date stamp, it is allowed to proceed and a new time stamp is computed in accordance with the rate parameter. One exemplary computation adds to the time stamp a time interval obtained by dividing the size of the packet by the rate parameter and preferably subtracting from the quotient the time interval between the arrival time and the previous time stamp.

Packet metering in high-speed network units

An Ethernet data packet including a VLAN tag header and a VLAN identification field is modified. The modification is accomplished by inserting in place of the VLAN tag header a field of the same size including selected information. The VLAN identification may be retained. The inserted field may include a first field indicating the presence of the VLAN identification field and a second field of selected information, the second field being longer than the first field.

Modification of tag fields in Ethernet data packets

In a stack of network units each includes a multiplicity of ports for receiving and forwarding addressed data packets and a forwarding engine which in response to address data selects at least one port for the forwarding of a data packet. A cascade connects the units and allows the transmission of a packet placed on said cascade by a unit to all the other units. Each unit is responsive to a packet received from the cascade to forward or discard the received packet according to predetermined forwarding rules. A trunk includes a respective port of each of some but not necessarily all the units. Each unit includes a 'trunk box member' register indicating which of the units has at least one port connected in the trunk When a first unit in the stack receives, at a port connected neither to the trunk nor the cascade, a packet destined for the trunk, the first unit directs that packet to a port connected to the trunk if the first unit has such a port and otherwise sends that packet to the cascade. When a second unit in the stack, having a port connected to the trunk, receives by way of the cascade from the first unit a packet destined for the trunk, the second unit determines with recourse to the forwarding rules, data identifying the first unit and the respective register whether to forward said packet to the trunk. The invention is particularly intended for use in stack-wide trunks operating according to 'local forwarding' and &lsquo;next-in-line&rsquo; rules and allows units in the stack to be omitted from direct connection to the trunk.

Stackable network unit including register for identifying trunk connection status of stacked units

A network switch comprises a multiplicity of ports for receiving and forwarding addressed data packets, a forwarding engine for directing packets received at the ports to at least one other port, a register for storing unit identifications of a set of units including the network unit, and hashing logic for selecting one of the unit identifications in response to address data in a packet. The forwarding engine makes a determination whether the one of the unit identifications corresponds to the network unit and is operative to direct the packet in accordance with that determination. The use of the register enables a substantial increase in the number of ports that can be members of a stack-wide trunk.

Stackable network unit including registers for identifying stack members and trunk ports

A stackable multi-port communication device for a packet-based data communication system, having a multiplicity of physical ports for the reception and dispatch of data in the form of packets, includes switch logic for selecting for a packet at least one destination selected from a multiplicity of ports which include a logical port common to a specified group of said physical ports. A cascade trunk logic, coupled to the switch logic, is used for determining, for the dispatch of a packet directed to said logical port, a selected port of said group of said physical ports; and a remote monitoring logic is used for forwarding a copy of the packet. The remote monitoring logic stores an indication of all the physical ports on the unit from which the copy may be forwarded by the remote monitoring logic and prevents the forwarding of the copy of the packet to any physical port which corresponds to the port selected by the cascade logic for the dispatch of said packet, whereby a packet which is forwarded from any of the specified group of physical ports is not duplicated by the remote monitoring logic.

Port mirroring across a trunked stack of multi-port communication devices

A trie searching technique employs entries each including a pointer to the next block in the search and a status indication and also including start and end indexes which define a selected section of the trie key identifying an entry within the block identified by the pointer. Thereby the program for selection of the search key is defined by the trie entries themselves, enabling a general variety of search selections and jumps to avoid any unnecessary parts of the trie search key.

Method and apparatus for searching databases employing a trie search structure

A multiport network device includes a multiplicity of receive queues, a multiplicity of transmit queues and a forwarding engine for transferring entries from the receive queues to the transmit queues. When a transmit queue is greater than a first hysteresis point, the forwarding engine prevents transfer of entries from a receive queue to the transmit queue and transfer of entries to the transmit queue is allowed when the length of the transmit queue falls below a second hysteresis point.

Network switch including hysteresis in signalling fullness of transmit queues

In a stack of multi-port network communication units each unit has a forwarding database, the units are connected by way of a cascade, and at least some of the units are connected to links constituting a trunk. When a unicast data packet is received at a first of said units and the unicast data packet has a destination address which is not the subject of an entry in the forwarding database of the first unit, the unicast data packet is sent by way of the cascade to the other units in the stack, accompanied by a flag. When a second unit has in its forwarding database an entry, associating the destination address with forwarding data, it sends a management packet indicating said destination address and the identity of said second unit, so that the database of the first unit can be immediately updated.

Growing community of inventors

Ballyhooly, Ireland

Daniel M O'Keeffe