Juniper Networks, Inc.

Fuguang Shi

Gunes Aybay

Jack W Kohn

David Rowell

Jean-Marc Frailong

Anurag Agrawal

Harshad Bhaskar Nakil

Philip A Thomas

A device includes a memory, flow table logic, sampling logic, and a processing unit. The memory is configured to store a flow table that stores, as a number of entries, statistics regarding a number of data flows. The flow table logic is configured to generate records corresponding to data flows for which entries are created in the flow table or removed from the flow table. The sampling logic is configured to select one of the data flows for sampling and sample initial data units for the one of the data flows. The processing unit is configured to receive the records generated by the flow table logic, receive the initial data units sampled by the sampling logic, analyze the initial data units to generate analysis results, correlate the records and the analysis results associated with a same one of the data flows, and store the correlated records and analysis results.

Traffic analysis of data flows

A device may include a flow table to store, in flow table records, statistics associated with a number of data flows, and a flow type table to store, in flow type table records, information that indicates whether to store statistics in the flow table for each of a number of types of data flows, information that indicates a manner for sampling data units associated with the data flows, and/or information that indicates when to delete flow table records from the flow table.

Managing a flow table

A device may include logic configured to receive a packet, identify a flow associated with the packet in a flow table, and identify a rate limit associated with the flow in the flow table. A current rate associated with the flow may be calculated based on the packet. It may be determined whether the current rate associated with the flow exceeds the rate limit associated with the flow. If so, the packet may be discarded or tagged as 'over limit.'

Flow-based rate limiting

A device may include two or more line interfaces. One of the line interfaces may include a component to buffer a packet that is received at the line interface, perform a lookup of information related to selecting a flow based on a header of the packet, apply a symmetric hash function to addresses in the header to obtain a hash when the information related to selecting the flow indicates the flow is to be selected based on a random method, compare the hash to a particular number using the information related to selecting the flow, the particular number being same for the line interfaces, sample a flow when the hash matches the particular number, create a flow record for the flow, and sample packets based on the flow record.

Targeted flow sampling

A method includes installing an interface card having a first module of a switch fabric and a second module of the switch fabric, and an interface card having a third module of the switch fabric in a first chassis, within a first time period. The switch fabric is in a first configuration and is operable as a three-stage switch fabric after the first time period and before a second time period. The interface card having the third module is removed from the first chassis within the second time period. An interface card having a fourth module of the switch fabric and a fifth module of the switch fabric is installed in the first chassis within the second time period. The switch fabric is in a transitional configuration and is operable as a three-stage switch fabric after the second time period but before the third time period. The interface card having the third module is installed in a second chassis and the first chassis is operatively coupled with the second chassis within the third time period. The switch fabric is in a third configuration and is operable as a five-stage switch fabric after the third time period.

Methods and apparatus for upgrading a switch fabric

A device may receive a data unit at a line interface of a network device, convey the data unit to a first component in the line interface, update a flow table in the first component based on the data unit, send a message to a second component in the network device, the message describing the update to the flow table, and forward the data unit from the first component to another line interface in the network device.

Network traffic analysis using a flow table

A device may receive a data unit and identify a class of the received data unit. The device may further obtain a service tag based on the class of the data unit and send the service tag and the data unit to a service module in the network device. The service module may perform a service for the data unit.

Redirecting data units to service modules based on service tags and a redirection table

A network device may include logic configured to receive a packet from a packet forwarding engine, create a flow ID for the packet, determine whether the flow ID matches one of a plurality of flow IDs in a table, determine whether the packet is associated with a flow to be sampled, sample the packet and additional packets associated with the flow that are received from the packet forwarding engine when the flow is to be sampled and transmit the flow ID and the sampled packets via a switch to an interface.

Growing community of inventors

Saratoga, CA, United States of America

Fuguang Shi