Cisco Technology, Inc.

Jianyu Chen

David Delano Ward

John H W Bettink

Paul Mattes

Norbert Brotz

Jian Long Yang

Dong Li

Jan Maksymilian Gronski

John Bettink

Chung T Nguyen

Peramanayagam Marimuthu

Xiaoqing Lu

Rajiv Goel

Scott Molloy

Packets destined for the route processor of a packet switching device are rate controlled. Typically, line cards are configured to rate limit packets of offending packet flows destined for the route processor, such, but not limited to in response to a quantity of packets in the route processor. Filtering of packets of offending packet flows at the line cards reduces the work required of the route processor.

Rate controlling of packets destined for the route processor

A method is disclosed for dynamically creating encapsulation and decapsulation chains and segmenting the packet-forwarding plane. A distributed router may comprise multiple cards, each exposing a subset of the router's physical interfaces. Some physical interfaces may be configured to send/receive only certain types and destinations of data packets. Some cards might not expose any physical interfaces configured to send/receive a particular type and destination of packet, making encapsulation and/or decapsulation chains for virtual interfaces that process data packets of the particular type useless on those cards. Therefore, instead of always creating both encapsulation and decapsulation chains for a virtual interface on a card, an aspect of the method dynamically determines which of the encapsulation and decapsulation chains are useful for a virtual interface on that card, and creates only those chains that are useful on that card. Thus, the packet-forwarding plane is segmented into independent encapsulation and decapsulation segments.

Dynamic chain creation and segmentation of the packet-forwarding plane

In one embodiment, a code server and edit server are provided. The code server stores the source code. Users do not access the code server directly. Rather, an edit server is used where users can log in to the edit server and send requests to edit portions of the source code. The edit server then sends requests to the code server for requested portions of the source code. Different users may have different access-rights to portions of the code. When the request is received from the edit server, if the code server determines the user requesting the portion of the source code does not have access rights to it, then the code server does not allow the portion of code to be accessed. However, if the user does have access rights, then the portion of the source code is retrieved and sent to the edit server. The user can then edit the source code on the edit server.

Filtering access to data objects

Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms, for identifying admission control policies and enforcement of these admission control policies on packets destined for a route processor. A typical routing device includes: a route processor, a forwarding lookup mechanism for identifying packets destined for the route processor; a lookup mechanism for identifying admission control parameters for packets destined for the route processor; and an admission control enforcement mechanism for enforcing the identified admission control policy parameters for the packets.

Dynamically controlling the rate and internal priority of packets destined for the control plane of a routing device

Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, and mechanisms, for a route processor adjusting admission control policies for packets destined for the route processor and enforced on line cards. Individual line cards can identify offending packet flows that pass through them. However, for example, it is possible that an attack on the route processor might comprise packets being forwarded to the route processor from different line cards, with these packets belonging to a same or different packet flow. By monitoring and identifying offending packet flows, the route processor can inform at least the line cards corresponding to these offending packet flows in order to adjust their corresponding admission control policies to combat such an attack, while typically allowing legitimate traffic to continue to flow at the desired rate to the route processor.

Route processor adjusting of line card admission control parameters for packets destined for the route processor

Growing community of inventors

San Jose, CA, United States of America

Jianyu Chen