Palo Alto Networks, Inc.

Xilinx, Inc.

Gyanesh Saharia

Sidong Li

William Alan Roberson

Subramani Ganesh

Savitha Raghunath

Ephrem C Wu

De Bao Vu

A network security device includes a network flow statistics processing engine to process network flow information related to network flows. The network flow statistics processing engine includes a first processing stage performing per-flow information aggregation and a second processing stage performing per-destination system component information aggregation, with each processing stage implementing a threshold-based data export scheme and a timer-based data export scheme. In this manner, up-to-date flow information is available to peer system components regardless of the varying flow rates of the network flow.

Network device implementing two-stage flow information aggregation

A security device includes a controller configured to determine a flow identifier and an event counter associated with a received data packet and a counter memory including multiple memory banks where each memory bank stores a partial counter value for one or more event counters. The counter memory is indexed by a counter identifier associated with the event counter. A memory controller selects a memory bank in the counter memory that was not the memory bank last selected and the partial counter value associated with the counter identifier in the selected memory bank is updated, the updated partial counter value being written back to the selected memory bank. In one embodiment, the partial counter value is updated and written back within the latency window of the memory bank last selected.

Security device using high latency memory to implement high update rate statistics for large number of events

A memory arrangement includes a plurality of memory blocks, a first group of access ports, and a second group of access ports. Routing circuitry couples each pair of the first and second groups of access ports to a respective one of the memory blocks. Each pair includes a first access port from the first group and a second access port from the second group. The first access port has write access to a first portion of the respective memory blocks but not to a second portion of the memory block, and has read access to the second portion but not to the first portion. The second access port has write access to the second portion but not to the first portion, and has read access to the first portion but not to the second portion.

Contention-free memory arrangement

Growing community of inventors

Cupertino, CA, United States of America

Gyanesh Saharia