Juniper Networks, Inc.

Hsien-Chung Woo

Stephen Wilson Turner

Sanjay Kalra

Truman Joe

Wendy R Cartee

Dennis C Ferguson

Lawrence Hui

Scott Mackie

Manoj Leelanivas

A system comprises a plurality of processing modules, one of which is designated to be the primary processing module and the others are designated to be secondary processing modules. During operation, state is maintained in the primary processing module and at least one of the secondary processing modules. A switchover controller causes outputs from the secondary modules to be discarded. When the switchover controller receives an indication that the primary processing module has failed, it designates one of the secondary processing modules to be the primary processing module. Because the newly designated primary processing module already has current state information at switchover, the module is able to operate with minimal delay.

Automatic switchover mechanism in a network device

A network router includes a set of interface cards to receive packets from a network, and a set of accounting modules to calculate flow statistics for the packets. The router further includes a control unit to adaptively update routing information in response to the calculated flow statistics, and to route the packets in accordance with the routing information. The control unit identifies potentially malicious packet flows for the received packets based on the flow statistics, and applies an intercept filter to intercept the packets of the identified packet flows. The control unit analyzes the intercepted packets in real-time to determine the presence of a network event, and updates the routing information based on the determination, e.g., by terminating routing for packets associated with malicious packet flows. In this manner, the router may adaptively respond to network events, such as network security violations.

Adaptive network router

Techniques are described to replicate multicast packets in accordance with a hierarchical data structure. For example, upon receiving a multicast packet, a packet-forwarding engine may communicate the packet to packet-forwarding engines corresponding to starting nodes of the hierarchical data structure. The packet-forwarding engines corresponding to starting nodes of the hierarchical data structure may replicate the multicast packet for local interface cards, and forward the replicated packets to the network. Furthermore, the packet-forwarding engines may replicate the packet for packet-forwarding engines corresponding to downstream nodes. In this manner, the packet replication process is distributed throughout the router decreasing the complexity of necessary replication hardware. Furthermore, the packet replication process is highly scalable resulting in a latency of one fabric hop when the number of packet-forwarding engines doubles. Also, when the hierarchical data structure has more than one starting node, the packet replication process is less susceptible to a single point failure.

Multicast packet replication

A network device integrates accounting functionality for generation of flow statistics with packet intercept functionality to provide a comprehensive traffic analysis environment. The device comprises a set of network interface cards to receive packets from a network, and a set of accounting service cards to calculate flow statistics for the packets. The device further comprises a control unit to receive the network packets from the interface cards and distribute the packets to the set of accounting service cards. The accounting service card comprises an interface for insertion within a slot of a network device. Accounting service cards may be added to easily scale the network device to support higher bandwidth communication links, such as OC-3, OC-12, OC048 and higher rate links. Additional accounting service cards may be used for purposes of redundancy to support continuous, uninterrupted packet processing and accounting in the event of a card failure.

Network device having accounting service card

A routing system decouples the routing functionality from the packet forwarding functionality. The decoupling of functionality is accomplished by coupling a set of routing engines to a set of packet-forwarding engines via a switch. The decoupling of functionality allows the routing system to easily be reconfigured and scaled. The decoupling of functionality also reduces the susceptibility of concurrently executing software processes from the malfunction of a single software process.

Scalable routing system

A network router integrates routing functionality with accounting functionality for generation of flow statistics, and provides packet intercept functionality to provide a comprehensive traffic analysis environment. The router includes a set of interface cards to receive packets from a network, and a control unit to generate a first and second duplicate stream of the packets. The control unit provides the packets of the first stream to accounting modules for calculation of flow statistics, and applies an intercept filter to intercept at least a subset of the packets of the second stream for selected packet flows.

Growing community of inventors

Fremont, CA, United States of America

Hsien-Chung Woo