Juniper Networks, Inc.

Netscreen Technologies, Inc.

Dongping Luo

Yan Ke

Feng Deng

Wen Wei

Xiangdong Jin

Aibing Zhou

Lidong Zhao

A gateway for screening packets transferred over a network. The gateway includes a plurality of network interfaces, a memory and a memory controller. Each network interface receives and forwards messages from a network through the gateway. The memory temporarily stores packets received from a network. The memory controller couples each of the network interfaces and is configured to coordinate the transfer of received packets to and from the memory using a memory bus. The gateway includes a firewall engine couples to the memory bus. The firewall engine is operable to retrieve packets from the memory and screen each packet prior to forwarding a given packet through the gateway and out an appropriate network interface. A local bus is coupled between the firewall engine and the memory providing a second path for retrieving packets from memory when the memory bus is busy.

Firewall including local bus

A system uses software to perform a first portion of a linked list traversal process, where the first portion obtains a pointer that corresponds to a key and where the pointer points into a linked list. The system further uses hardware and the obtained pointer to perform a second portion of the linked list traversal process, where the second portion locates data from the linked list that is associated with the key.

Instruction extension for linked list lookup

A device may include logic configured to receive a data unit intended for a destination device and to obtain information from the data unit. The logic may be configured to identify a window using the obtained information, where the window has a range determined by a lower boundary and an upper boundary. The logic may be configured to forward the data unit to the destination device when a portion of the data unit information is within the window.

Session-based sequence checking

A linked list traversal system identifies when a linked list has become inefficient, either through attack or an undue multiplicity of collisions. A data unit is parsed to extract a key. A first hash result associated with the key is calculated based on a first hash function. A first linked list is identified based on the first hash result. It is determined whether the first linked list has been compromised. A second hash result associated with the key is calculated based on a second hash function when the first linked list has been compromised. A second linked list is established based on the second hash result, where the second hash result is different from the first hash result.

Linked list traversal with reduced memory accesses

A gateway for screening packets transferred over a network. The gateway includes a plurality of network interfaces, a memory and a memory controller. Each network interface receives and forwards messages from a network through the gateway. The memory temporarily stores packets received from a network. The memory controller couples each of the network interfaces and is configured to coordinate the transfer of received packets to and from the memory using a memory bus. The gateway includes a firewall engine coupled to the memory bus. The firewall engine is operable to retrieve packets from the memory and screen each packet prior to forwarding a given packet through the gateway and out an appropriate network interface. A local bus is coupled between the firewall engine and the memory providing a second path for retrieving packets from memory when the memory bus is busy.

Techniques are described for detecting corruption of buffer pointers passed between a local processor and a remote processor on a network device. For example, the first processor, which may be a memory controller, receives and stores packets within memory. A second processor, such as a host processor for the network device, is coupled to the first processor by a bus. The first processor communicates a memory pointer associated with an a given packet to the second processor for processing of the packet, and maintains a backup copy of the memory pointer. Upon receiving the memory pointer back from the second processor, the first processor compares at least a portion of the memory pointer received from the second processor with an equivalent portion of the copy of the memory pointer to determine whether the received memory pointer has been corrupted.

Detection of corrupted memory pointers within a packet-processing device

A gateway for screening packets transferred over a network. The gateway includes a plurality of network interfaces, a memory and a memory controller. Each network interface receives and forwards messages from a network through the gateway. The memory temporarily stores packets received from a network. The memory controller couples each of the network interfaces and is configured to coordinate the transfer of received packets to and from the memory using a memory bus. The gateway includes a firewall engine coupled to the memory bus. The firewall engine is operable to retrieve packets from the memory and screen each packet prior to forwarding a given packet through the gateway and out an appropriate network interface. A local bus is coupled between the firewall engine and the memory providing a second path for retrieving packets from memory when the memory bus is busy. An expandable external rule memory is coupled to the local bus and includes one or more rule sets accessible by the firewall engine using the local bus. The firewall engine is operable to retrieve rules from a rule set and screen packets in accordance with the retrieved rules.

Growing community of inventors

Fremont, CA, United States of America

Dongping Luo