3com Corporation

Hewlett-packard Development Company, L.p.

3com Technologies

Hewlett-packard Company

Broadcom Corporation

3com Ireland

Eugene O'Neill

Edele O'Malley

Kam Choi

David J Law

Anne G O'Connell

Daniel M O'Keeffe

Bryan J Donoghue

Paul J Moran

Jerome Nolan

Una Quinlan

Neil O Fanning

Maurice A Goodfellow

Quang T Tran

Richard A Gahan

Joseph N Butler

Kevin Jennings

Kevin Loughran

Mark A Hughes

Con David Cremin

Peter Furlong

Sorcha O'Callaghan

Tadhg Creedon

William Paul Sherer

Niall Hanrahan

Gareth Edward Allwright

Vincent Gavin

Francisco Aquino

John Hickey

Tin Lam

Eoin O'Brien

Ciaran Murphy

Jennifer Hamilton

J Noel Butler

Micheal Lardner

Paul Flood

Sorcha Callaghan

Richard Gahan

Maunte A Goodfellow

Maurice Gleeson

Maurice Arthur Goodfellow

In one embodiment, a method is described for detecting an operational failure between the network unit and an adjacent network unit in the stack; controlling the switching engine to redirect packets which would otherwise be sent from a particular port to the adjacent network unit to be forwarded from another port to be sent to a different network unit in the stack; and entering the switching engine into a bypass mode in response to control data indicating an operational failure between at least two other network units in the stack to cause packets to be forwarded without being re-directed by the switching engine.

Cascade system for network units

The occurrence of false positives and the post-processing of digital streams subjected to examination by a deterministic finite state machine for character strings are reduced by combining location-based pattern matching, e.g. on packet headers, and content-based pattern matching, e.g. on payloads of packets. One scheme allows automatic transition from a header match state into an initial state of a content matching machine. Another scheme is based on a rules graph defining strings of match states and the examination of a list of match states (rather than characters) which have been previously determined, for example by means of header matching and content matching. The latter is also capable of comparing offset and depth values associated with the match states with offset and depth criteria.

Signature checking using deterministic finite state machines

An apparatus including logic to receive a data packet comprising a string of characters, said apparatus having a plurality of states and at least one state for every character position in the string of characters; logic to examine the string of characters for matches with a plurality of predefined values, beginning with an initial character; and logic to execute forward exit transitions from any of the plurality of states based upon the examination of the characters, wherein a current state of the apparatus represents a count of a number of characters from the initial character of the string of characters.

Positionally dependent pattern checking in character strings using deterministic finite automata

A network stack includes a plurality of network units each of which includes a multiplicity of ports for receiving and forwarding addressed data packets, at least two cascade ports and a switching engine for forwarding received packets to at least one port in accordance with address data in the packets and a cascade connection including, for each of two opposite directions around the stack, at least one unidirectional path for data packets composed of links each between a respective cascade port on a network unit and a corresponding cascade port on the next network unit.

A network switch includes a look-up engine for obtaining associated data in response to a header portion of a packet and an interlinked network processor such as a RISC for performing a processing function on the header portion or the associated data. Both look-up engine and the network processor may modify a destination port bitmask. The network processor may implement additional packet header processing required for replication or server load balancing.

Network switch with mutually coupled look-up engine and network processor

A cascade system of network units includes forwarding units which have external ports, a communication fabric connecting the units and at least one processing unit which needs no forwarding database. The processing unit may perform a security operation such as intrusion prevention or encryption. Each forwarding unit on receipt of a packet performs a look-up to determine an egress port, to determine whether the packet must be diverted to a processing unit, to provide the packet with a first forwarding instruction identifying the egress port uniquely within the system and a second forwarding instruction identifying a diversion port by which the packet can reach the processing unit and to set an order field which determines which of the forwarding instructions shall be performed first. The processing unit is operative on receipt of the packet by way of the diversion port to change the order field to specify that the packet should now be sent to the egress port.

Packet diversion in switching fabrics and multiple forwarding instructions for packets

Multicast packets that are received on a port of a network device and forwarded to multiple output ports are stored in memory and respective primary control entries which define them are converted to secondary control entries defining multiple unicast packets before a scheduling algorithm is applied. The packets are reconstituted after the application of the scheduling algorithm has been applied to the control entries. For VPLS packets that are received on a single port and replicated multiple times on one or more output ports, a replication database may be used in conjunction with a replication engine to convert the control entry for a received packet into multiple control entries defining unicast packets for each of the destination ports before the scheduling algorithm is applied. This method is applicable to the replication of packets onto a Virtual Private LAN.

Maintenance of bandwidth allocation for traffic including multicasts

A deterministic finite state machine organised for the detection of positionally significant matches of characters in a string of characters examines each character in turn to determine a exit transition for a current state of the machine to another state The machine responds to an examination of the string of characters by executing in response to a first character at the commencement of the string a transition from an initial state to another state. The machine has at least one state for every character position, includes a exit transition from each state for each character to another state; and possesses only forward exit transitions each from any of the states whereby the current state of the machine unambiguously represents a count of the number of characters from the commencement of the string. The machine may include at least one match state which indicates that all character matches in the string required by at least one respective rule have been detected. Some but not all the states in the multiplicity of states each have a single exit transition for any value of a respective character in the string. At least some of the states in the multiplicity of states each define an exit transition to a state indicating 'no match'. The machine may be disposed to cease its examination of the character string on attaining a 'no match'state.

A method performs a lookup on a search key word, employing a trie database including multiple trie blocks that include pointers to other trie blocks. Each trie is accessible by means of a segment of the search key. A selected section of the search key word is applied to a content addressable memory. In the event of an absence of a match of the selected section with an entry in the content addressable memory, a trie search is performed on the whole search key word. In the event of a match of the selected section with an entry in the content addressable memory, a partial trie search is performed, commencing with a first segment of the search key word after the selected section that has been matched in the content addressable memory.

Trie search engines and ternary CAM used as pre-classifier

A multi-port network unit for use in a cascade system of network units sends from a cascade port a packet including a special header having a source port ID, a destination port ID and a 'destination port known' field. The port IDs identify both a unit and a port within a unit. A routing database is set up, optionally by a discovery protocol, in terms of ports and either destination units (within the cascade) or source units (within the cascade). The database includes a mesh table, indicating from which cascade port a packet with a known destination port ID should be forwarded, without needing a fresh look-up. The database also includes a multicast exclusion table which allows ingress of packets with source unit IDs matched to an ingress port. The scheme allows a general mesh type of cascade while dynamically preventing closed loops.

Network units for use in and organisation of cascade systems

A content addressable memory stores entries each comprising a rule and as part of the entry a mask identifying all the entities to which the rule is applicable. A search pattern of data and a bit mask identifying the actual entity (or entities) associated with the data is applied as a search word along with a comparison mask that excludes all the other entities from the comparison of the search word with the entry. The CAM can thereby store efficiently in a single entry a rule that may be applicable to some but not all of a multiplicity of entities such as possible ingress ports of a network unit.

Content addressable memory organized to share entries between different entities such as ports of a network unit

A rules engine for the examination of selected fields in an addressed data packet has an access control list table of which the entries each define an access control list rule, an action and a chain identifier. The access control list rule may be a basic rule which refers to network addresses and transport layer port numbers. The rules engine also has an extension rule table of which the entries each define an extension rule, a respective action and a respective rule identifier. The extension rule may refer to a particular TCP flag. When a packet arrives, the engine searches both tables. This search is made independently of the ordinary network layer or link layer address lookup. If there is a match in both tables, and the chain identifier matches the extension rule identifier, the rules engine prescribes the action associated with the extension rule. If the chain identifier of a matched access control list rule does not match a rule identifier of a matched extension rule the rules engine prescribes the action associated with the basic rule. In the absence of a match with any access control list rule the action on a packet is based on the result from the ordinary address lookup.

Rules engine for access control lists in network units

A system of switch modules contains input demultiplexers connected to ports on each of the modules and output multiplexers connected to each of the modules. Each module has output and input interfaces for mesh links and at least one output interface is looped back to an input interface on the same module. The arrangement reduces module-to-module traffic and corresponding increases the transmit bandwidth of a module.

High-speed switch architecture

Growing community of inventors

Dublin, Ireland

Eugene O'Neill