3com Corporation

3com Technologies

Hewlett-packard Development Company, L.P.

Hewlett-packard Company

Edele O'Malley

Kam Choi

Eugene O'Neill

Kevin Jennings

John F Hickey

David J Law

Daniel M O'Keeffe

Jerome Nolan

Bryan J Donoghue

Paul J Moran

Kevin Loughran

Maurice A Goodfellow

Quang T Tran

Sorcha O'Callaghan

Raymond Beechinor

Gareth Edward Allwright

Christopher Hay

Richard A Gahan

Eoin O'Brien

Ray Beechinor

Eugene O'Neil

Christopher Gilbert

Maunte A Goodfellow

Maurice Arthur Goodfellow

In one embodiment, a method is described for detecting an operational failure between the network unit and an adjacent network unit in the stack; controlling the switching engine to redirect packets which would otherwise be sent from a particular port to the adjacent network unit to be forwarded from another port to be sent to a different network unit in the stack; and entering the switching engine into a bypass mode in response to control data indicating an operational failure between at least two other network units in the stack to cause packets to be forwarded without being re-directed by the switching engine.

Cascade system for network units

The occurrence of false positives and the post-processing of digital streams subjected to examination by a deterministic finite state machine for character strings are reduced by combining location-based pattern matching, e.g. on packet headers, and content-based pattern matching, e.g. on payloads of packets. One scheme allows automatic transition from a header match state into an initial state of a content matching machine. Another scheme is based on a rules graph defining strings of match states and the examination of a list of match states (rather than characters) which have been previously determined, for example by means of header matching and content matching. The latter is also capable of comparing offset and depth values associated with the match states with offset and depth criteria.

Signature checking using deterministic finite state machines

A network stack includes a plurality of network units each of which includes a multiplicity of ports for receiving and forwarding addressed data packets, at least two cascade ports and a switching engine for forwarding received packets to at least one port in accordance with address data in the packets and a cascade connection including, for each of two opposite directions around the stack, at least one unidirectional path for data packets composed of links each between a respective cascade port on a network unit and a corresponding cascade port on the next network unit.

A cascade system of network units includes forwarding units which have external ports, a communication fabric connecting the units and at least one processing unit which needs no forwarding database. The processing unit may perform a security operation such as intrusion prevention or encryption. Each forwarding unit on receipt of a packet performs a look-up to determine an egress port, to determine whether the packet must be diverted to a processing unit, to provide the packet with a first forwarding instruction identifying the egress port uniquely within the system and a second forwarding instruction identifying a diversion port by which the packet can reach the processing unit and to set an order field which determines which of the forwarding instructions shall be performed first. The processing unit is operative on receipt of the packet by way of the diversion port to change the order field to specify that the packet should now be sent to the egress port.

Packet diversion in switching fabrics and multiple forwarding instructions for packets

A multi-port network unit for use in a cascade system of network units sends from a cascade port a packet including a special header having a source port ID, a destination port ID and a 'destination port known' field. The port IDs identify both a unit and a port within a unit. A routing database is set up, optionally by a discovery protocol, in terms of ports and either destination units (within the cascade) or source units (within the cascade). The database includes a mesh table, indicating from which cascade port a packet with a known destination port ID should be forwarded, without needing a fresh look-up. The database also includes a multicast exclusion table which allows ingress of packets with source unit IDs matched to an ingress port. The scheme allows a general mesh type of cascade while dynamically preventing closed loops.

Network units for use in and organisation of cascade systems

A content addressable memory stores entries each comprising a rule and as part of the entry a mask identifying all the entities to which the rule is applicable. A search pattern of data and a bit mask identifying the actual entity (or entities) associated with the data is applied as a search word along with a comparison mask that excludes all the other entities from the comparison of the search word with the entry. The CAM can thereby store efficiently in a single entry a rule that may be applicable to some but not all of a multiplicity of entities such as possible ingress ports of a network unit.

Content addressable memory organized to share entries between different entities such as ports of a network unit

A rules engine for the examination of selected fields in an addressed data packet has an access control list table of which the entries each define an access control list rule, an action and a chain identifier. The access control list rule may be a basic rule which refers to network addresses and transport layer port numbers. The rules engine also has an extension rule table of which the entries each define an extension rule, a respective action and a respective rule identifier. The extension rule may refer to a particular TCP flag. When a packet arrives, the engine searches both tables. This search is made independently of the ordinary network layer or link layer address lookup. If there is a match in both tables, and the chain identifier matches the extension rule identifier, the rules engine prescribes the action associated with the extension rule. If the chain identifier of a matched access control list rule does not match a rule identifier of a matched extension rule the rules engine prescribes the action associated with the basic rule. In the absence of a match with any access control list rule the action on a packet is based on the result from the ordinary address lookup.

Rules engine for access control lists in network units

A system of switch modules contains input demultiplexers connected to ports on each of the modules and output multiplexers connected to each of the modules. Each module has output and input interfaces for mesh links and at least one output interface is looped back to an input interface on the same module. The arrangement reduces module-to-module traffic and corresponding increases the transmit bandwidth of a module.

High-speed switch architecture

A switching module has external ports for sending and receiving data packets and mesh interfaces for internal mesh connections with other modules. A switching engine directs packets to one or other of the mesh interfaces according to the port number of a 'destination' or egress port on another module, as determined by a lookup. The port numbers are programmable so that the distribution of traffic through the mesh connections can be modified.

Switch module architecture

Network units such as switches for use in a cascaded stack are organised to provide a cascade connection in the form of a dual unidirectional connection so that, in its ordinary configuration, there is at least one and preferably more than one unidirectional ring for each direction around the cascade, each ring including a respective port on each unit. For each ring, each port on a unit is connected by a respective link to a corresponding port on the preceding unit and the following unit. The units provide a self-healing operation in the event of various kinds of operational failure. The self-healing operation includes loop-back of packets in units adjacent the failure and bypass of a packet switching process for other units. The units include control logic for passing control frames containing status information relating to the units and links between them and for co-operation with a CPU to control a switching engine to perform the self-healing operation in accordance with that status information. The units forward on the cascade packets with headers that identify a destination port and the unit on which that port is located and also indicate which units have and have not been traversed by a packet.

Cascade control logic for use in a switch or other network unit that can be used in a cascaded stack can maintain normally a point-to-point half-duplex connection for control data with each of the next preceding and next succeeding units in the cascade. Each cascade logic device is organised so that for one direction, conveniently called the up direction, a device is a master and in the other direction the device is a slave in respect of the control path. A control device will generate master control frames in the up direction and deliver slave control frames in the down direction. The control device is organised so that in the absence of reception of valid control frames on a control link control data which would otherwise be sent out on that link is looped back within the control device. In this manner the control device can maintain under normal circumstances two virtual control channels which can 'self-heal' notwithstanding the failure or powering-down of a unit in the cascade. Status information represented by the control frames can be used to control a switching engine to provide self healing of the data path in the cascade.

Cascade control system for network units

A communication device which includes a hardware trie search facility. At least part of a memory is divided into memory blocks, each of said blocks consisting of a multiplicity of locations, at least some of said locations each providing when accessed a pointer to another block and an indication of the size of the block. A shift register holds an address key, and a trie block is accessed using an address composed of a number of bits related to said indication of the size of the block. The key is shifted by said number of bits prior to a subsequent stage of the search. Part of the memory comprises an associated data table which includes entries of data enabling a packet to be forwarded and at least some locations in said blocks provide when accessed a pointer to an entry in the associated data table.

Communication device with forwarding database having a trie search facility

Trunking or other relationship is defined between ports on different devices in a cascade-connected stack of network devices. When network communications are passed via the cascade connection an indication is included of whether it originated from a port that is part of a trunk and thereby port-mismatch errors can be avoided.

Trunking in stacked communication devices

The present invention is based on a ring architecture wherein each chip in the multiplicity of chips is connected in a chain so that it can receive packets from the next previous chip in the chain and forward packets to the next following chip in the chain, whereby to form a ring. Before a packet is placed on the ring by a device it is provided with a 'masking' field which identifies each of the other devices and the ports within any such device to which the packet must be sent in order to achieve a multicast. When a device in its turn receives such a packet it will examine the masking field to determine whether the field identifies that device. If so, the packet, which may be held in temporary storage, may be processed for forwarding from a port of that device. The device will strip from the masking field the identification of the respective device and transmit the packet with a thus modified masking field to the next device in turn. If a packet does not contain any indication of another device in the ring, the packet will not be transmitted and therefore will naturally terminate.

Growing community of inventors

Dublin, Ireland

Edele O'Malley