Cisco Technology, Inc.

Washington University

John Andrew Fingerhut

John Joseph Williams, Jr

Earl T Cohen

Zubin D Dittia

William Norman Eatherton

Donald Edward Steiss

Jonathan S Turner

Daniel E Lenoski

Doron Shoham

Jonathan Rosen

Barry Scott Burns

Shimon Listman

Samar Sharma

Flavio Giovanni Bonomi

Michael Brian Galles

Murali Basavaiah

Kenneth Harvey Potter, Jr

George Varghese

Thomas Dejanovic

Shashank Gupta

James Alexander Markevitch

Man Kit Tang

Jonathan E Michelson

Christopher E White

Rakesh B Goudar

Balamurugan Ramaraj

Johannes Markus Hoerler

Chandrashekarappa Surekha Puttasubbappa

Will Eatherton

John Williams

John J Williams

Kenneth Harvey Potter

A network element includes one or more hardware memory resources of fixed storage capacity for storing data used to configure a plurality of networking features of the network element. A utilization management process runs on the network element to perform operations including obtaining utilization data representing utilization of the one or more hardware memory resources, and analyzing the utilization data of the one or more hardware memory resources to produce summarized utilization data.

Determining network element analytics and networking recommendations based thereon

An example method includes partitioning a memory element of a router into a plurality of segments having one or more rows, where at least a portion of the one or more rows is encoded with a value mask (VM) list having a plurality of values and masks. The VM list is identified by a label, and the label is mapped to a base row number and a specific number of bits corresponding to the portion encoding the VM list. Another example method includes partitioning a prefix into a plurality of blocks, indexing to a hash table using a value of a specific block, where a bucket of the hash table corresponds to a segment of a ternary content addressable memory of a router, and storing the prefix in a row of the segment.

System and method for packet classification and internet protocol lookup in a network environment

A method and system to detect an evasion attack are provided. The system may include a repository to store signature fragments that together constitute an attack signature, an interceptor to intercept a data packet associated with a network connection, a string-matching module to determine whether the payload of the data packet includes any of the stored signature fragments thereby identifying a match, a responder to perform a prevention action in response to the match, and a detector to detect that a size of the data packet is less than a size threshold. The system may further include a state machine to commence maintaining a state for the network connection in response to the detector determining that the size of the data packet is less than the size threshold.

Methods and systems to detect an evasion attack

Disclosed are, inter alia, methods, apparatus, data structures, computer-readable media, mechanisms, and means for a storage controller (e.g., memory controller, disk controller, etc.) performing a set of multiple operations on cached data with a no-miss guarantee until the multiple operations are complete, which may, for example, be used by a packet processor to quickly update multiple statistics values (e.g., byte, packet, error counts, etc.) based on processed packets. Operations to be performed on data at the same address and/or in a common data structure are grouped together and burst so that they arrive at the storage system in contiguous succession for the storage controller to perform. By not allowing the storage controller to flush the data from its cache until all of the operations are performed, even a tiny cache attached to the storage controller can reduce the bandwidth and latency of updating the data.

Storage controller performing a set of multiple operations on cached data with a no-miss guarantee until all of the operations are complete

An interface is operable to receive an element for deletion from a bloom filter. The bloom filter includes multiple hash functions and an array. A processor is operable to generate hash function output values for the element using the hash functions. The hash function output values correspond to indices identifying bits in the array. A memory is operable to maintain supplemental data structure entries. The supplemental data structure has entries associated with the indices. The processor is operable to modify the supplemental data structure entries to delete the element from the bloom filter.

Enhanced bloom filters

A processing engine includes descriptor transfer logic that receives descriptors generated by a software controlled general purpose processing element. The descriptor transfer logic manages transactions that send the descriptors to resources for execution and receive responses back from the resources in response to the sent descriptors. The descriptor transfer logic can manage the allocation and operation of buffers and registers that initiate the transaction, track the status of the transaction, and receive the responses back from the resources all on behalf of the general purpose processing element.

Descriptor transfer logic

An apparatus has at least one processing unit to generate a request having a request privilege level. At least one resource exists in the apparatus to receive the request and determine if the request is allowable. The apparatus includes an error handler that determines the nature of an error and performs a reset based upon the privilege level of the request that cause the error.

Selective error recovery of processing complex using privilege-level error discrimination

A resource interconnect architecture and associated descriptor protocol provides more efficient communication between different resources in a data processing system. One embodiment uses a backdoor interconnect that allows some resources to communicate without using a central resource interconnect. Another embodiment uses nested descriptors that allow operations by different resources to be chained together without having to communicate back to an originating descriptor resource. In another embodiment, the descriptors are generated in hardware or in software. Other embodiments assign priority or privilege values to the descriptors that optimize processing and error handling performance.

Method and apparatus for communicating over a resource interconnect

Sequences of items may be maintained using ordered locks. These items may correspond to anything, but using ordered locks to maintain sequences of packets, especially for maintaining requisite packet orderings when distributing packets to be processed to different packet processing engines, may be particularly useful. For example, in response to a particular packet processing engine completing processing of a particular packet, a gather instruction is attached to the particular identifier of a particular ordered lock associated with the particular packet. If no longer needed for further processing, the packet processing engine is immediately released to be able to process another packet or perform another function. The gather instruction is typically performed in response to the particular ordered lock being acquired by the particular identifier, with the gather instruction causing the processed particular packet to be sent.

Distributed packet processing with ordered locks to maintain requisite packet orderings

Data is protected using locks, with the protected data sometimes being included in the locking messages, which may reduce overall processing latency, and/or reduce a bandwidth requirement for and/or number of storage operations accessing the native storage of the protected data. For example, the lock manager receives lock requests from each of the requesters, and selectively grants the lock requests. The protected data is typically communicated in the locking messages when the lock is highly contested, or at least two request for access to the data are pending. The lock manager initiates the sequence by indicating in a grant message to a requester to include the protected data in its release message. The lock manager then copies this data received in the release message to its grant message to the next requestor. If no other requesters are waiting, the grant message includes an indication not to send the protected data, and thus the requestor typically stores this protected data to storage so it can be accessed in the future.

Bypassing native storage operations by communicating protected data within locking messages using a lock manager independent of the storage mechanism

Sequences of items may be maintained using ordered locks. These items may correspond to anything, but using ordered locks to maintain sequences of packets may be particularly useful. One implementation uses a locking request, acceptance, and release protocol. One implementation associates instructions with locking requests such that when a lock is acquired, the locking mechanism executes or causes to be executed the associated instructions as an acceptance request of the lock is implied by the association of instructions (or may be explicitly requested). In some applications, the ordering of the entire sequence of packets is not required to be preserved, but rather only among certain sub-sequences of the entire sequence of items, which can be accomplished by converting an initial root ordered lock (maintaining the sequence of the entire stream of items) to various other locks (each maintaining a sequence of different sub-streams of items).

Using ordered locking mechanisms to maintain sequences of items such as packets

A network processor has numerous novel features including a multi-threaded processor array, a multi-pass processing model, and Global Packet Memory (GPM) with hardware managed packet storage. These unique features allow the network processor to perform high-touch packet processing at high data rates. The packet processor can also be coded using a stack-based high-level programming language, such as C or C++. This allows quicker and higher quality porting of software features into the network processor. Processor performance also does not severely drop off when additional processing features are added. For example, packets can be more intelligently processed by assigning processing elements to different bounded duration arrival processing tasks and variable duration main processing tasks. A recirculation path moves packets between the different arrival and main processing tasks. Other novel hardware features include a hardware architecture that efficiently intermixes co-processor operations with multi-threaded processing operations and improved cache affinity.

Multi-threaded packet processing architecture with global packet memory, packet recirculation, and coprocessor

Packets and packets fragments possibly received out of sequence are distributed into an expandable set of queues. For each particular packet or fragment, a queue within a set of queues is identified that does not contain a packet or packet fragment that is subsequent to the particular packet or fragment, and the particular packet or fragment is enqueued therein. If there is not such a queue available, a new queue is added to the set of queues. A data structure is typically updated for packet fragments to identify when all fragments have been received and the order of queues containing the packet fragments in order of their position within the reassembled packet. This ordered list of the queues is communicated to a reassembly mechanism to retrieve the packet fragments and to reassemble the packet. Resequencing of packets is similarly performed, and may be part of the reassembly process. The list of queues is not always used by the reassembly/resequencing mechanism as the enqueued fragments/packets typically contain sequence numbers.

Distributing packets and packets fragments possibly received out of sequence into an expandable set of queues of particular use in packet resequencing and reassembly

Sequences of items may be maintained using ordered locks. These items may correspond to anything, but using ordered locks to maintain sequences of packets, especially for maintaining requisite packet orderings when distributing packets to be processed to different packet processing engines, may be particularly useful. For example, in response to a particular packet processing engine completing processing of a particular packet, a gather instruction is attached to the particular identifier of a particular ordered lock associated with the particular packet. If no longer needed for further processing, the packet processing engine is immediately released to be able to process another packet or perform another function. The gather instruction is performed in response to the particular ordered lock being acquired by the particular identifier, with the gather instruction causing the processed particular packet to be sent.

Methods and apparatus are disclosed for using barrier phases to synchronize processes and components in a packet switching system, including, for example, but not limited to the use of barrier phases in the coordinated timing of the sending of information (e.g., flow control information) within a packet switching system, and the use of barrier phases in a packet sequence number windowing protocol. In one implementation, elements are assigned to one of multiple ordered sets of a barrier groups, wherein each element of a barrier group must be set to a common barrier state before any element of a next a barrier group can switch to a next barrier state, and once all elements of a particular barrier group switch to a new barrier state, all the elements of the next barrier group begin to switch to the next barrier state.

Growing community of inventors

Campbell, CA, United States of America

John Andrew Fingerhut