Juniper Networks, Inc.

Silicon Graphics, Incorporated

Jumiper Networks, Inc.

John Keen

Jean-Marc Frailong

Jeffrey Glenn Libby

Anjan Venkatramani

Srinivas Perla

Deepak Goel

Sharada Yeluri

Jianhui Huang

Rajesh Nair

Avanindra Godbole

Anurag P Gupta

Venkatasubramanian Swaminathan

Srinivasan Jagannadhan

Srilakshmi Adusumalli

Pradeep S Sindhu

Martin M Deneroff

Gregory Michael Thorson

David Edward McCracken

Jian Hui Huang

Swaminathan Venkataraman

David Skinner

Azmeer Salleh

A firewall device may include a forwarding component that includes a filter block. The filter block may obtain a first hardware-implemented filter, where a hardware implementation limits the first hardware-implemented filter to a maximum quantity of rules; determine whether a last rule associated with the accessed hardware-implemented filter includes a split-filter action, where the split-filter action identifies a second hardware-implemented filter; and link the second hardware-implemented filter to the first hardware-implemented filter to make the second hardware-implemented filter a logical continuation of the first hardware-implemented filter, in response to determining that the last rule includes the split-filter action. The filter block may further determine whether a particular rule of the first hardware-implemented filter includes a next-filter action, where the next filter action identifies a third hardware-implemented filter; and process the third hardware-implemented filter independently of the sequence of hardware attachment points.

Hardware implementation of complex firewalls using chaining technique

A processor may include a conditional arithmetic logic unit and a main arithmetic logic unit. The conditional arithmetic logic unit may perform a first arithmetic logic operation to generate a first result, and output the result. The main arithmetic logic unit may select input buses among a plurality of data buses that carry the first result from the conditional arithmetic logic unit, perform a second arithmetic logic operation on data provided by the selected input buses to generate a second result, and write the second result in a storage component.

Efficient arithimetic logic units

A device may emulate target instructions by executing a first set of microinstructions, and may store a base address of a table that includes a microinstruction provided in a second set of microinstructions for emulating the target instructions. The device may also locate the microinstruction based on the stored base address, and emulate one of the target instructions by executing the microinstruction.

Emulation of multiple instruction sets

An example hashing unit includes a plurality of hardware-based hash tables, wherein each of the hash tables comprises a plurality of buckets, and wherein the plurality of hash tables comprise a set of zero or more active hash tables and a set of one or more inactive hash tables. An example hashing unit controller is configured to receive a key value to be stored in the hashing unit, determine that one of the inactive hash tables should be activated, and, based on the determination, activate the one of the set of inactive hash tables as a recently activated hash table, determine one of the buckets of the recently activated hash table to which a hash function associated with the recently activated hash table maps the received key value, and store the key value in the determined one of the buckets of the recently activated hash table.

Dynamically adjusting hash table capacity

An example network device includes a network interface configured to receive a packet of a packet flow, wherein the packet flow is one of a plurality of packet flows processed by the network device, a flow cache configured to receive a lookup key associated with the packet flow, and a Bloom filter configured to process the lookup key. The flow cache is further configured to store information about a portion of the plurality of packet flows processed by the network device, and determine whether to store information about the packet flow by at least applying a selection criterion to processing of the lookup key by the Bloom filter. The flow cache is configured to determine whether the lookup key is stored in the flow cache, and, when the lookup key is stored in the flow cache, retrieve a stored result associated with the lookup key and output the stored result.

Flow cache mechanism for performing packet flow lookups in a network device

Efficient arithmetic logic units

An example network device includes a control plane and a filter lookup module that includes a Bloom filter that supports parallel lookup of a maximum number of different prefix lengths. The filter lookup module accesses the Bloom filter to determine a longest length prefix that matches an entry in a set of prefixes. The control plane receives prefix lengths that include more than the maximum number of different prefix lengths supported by the Bloom filter, wherein the set of prefix lengths is associated with one application, generates, based on the received set of prefix lengths, two or more groups of different prefix lengths, wherein each of the two or more groups of different prefix lengths includes no more than the maximum number of different prefix lengths, and programs the filter lookup module with the two or more groups of different prefix lengths associated with the one application.

Longest prefix match searches with variable numbers of prefixes

Systems and methods of various embodiments provide mechanisms to support synchronous and asynchronous transactions. Distinct encodings allow an instruction to choose whether to perform any operation synchronously or asynchronously. Separate synchronous and asynchronous result registers hold the data returned in the most recent replies received for synchronous and asynchronous transaction requests, respectively. A status bit indicates whether an asynchronous transaction request is currently outstanding.

System and method for independent synchronous and asynchronous transaction requests

An example computing device includes a prefix lookup module, and a Bloom filter that includes a set of queues. The prefix lookup module is configured to receive policy configuration information, examine a state of a queue of the set of queues, and determine whether to bypass the first Bloom filter based on the policy configuration information and the state of the queue. In one example, the prefix lookup module may be configured to, using the policy configuration information, determine to bypass the Bloom filter when the queue is full. In another example, the prefix lookup module may be configured to, using the policy configuration information, determine not to bypass the Bloom filter and send a lookup request to the Bloom filter upon determining that the queue is no longer full.

Dynamic bypass mechanism to alleviate bloom filter bank contention

A device may receive a request to read data from or write data to a memory that includes a number of memory banks. The request may include an address. The device may perform a mapping operation on the address to map the address from a first address space to a second address space, identify one of the memory banks based on the address in the second address space, and send the request to the identified memory bank.

Convenient, flexible, and efficient management of memory space and bandwidth

Methods and systems consistent with the present invention provide efficient packet replication in a router in order to multicast a stream of data. Packets are replicated and processed in a multithreaded environment. Embodiments consistent with the present invention implement a two-stage process for packet replication. The first stage thread will recirculate the packet to multiple second-stage threads. These second-stage threads will then create one or more outgoing copies of the packet. In this way, the copies are handled by multiple threads running in parallel.

System and method for efficient packet replication

Methods and systems consistent with the present invention provide a programmable table which allows software to define a plurality of branching functions, each of which maps a vector of condition codes to a branch offset. This technique allows for a flexible multi-way branching functionality, using a conditional branch outcome table that can be specified by a programmer. Any instruction can specify the evaluation of arbitrary conditional expressions to compute the values for the condition codes, and can choose a particular branching function. When the processor executes the instruction, the processor's arithmetic/logical functional units evaluate the conditional expressions and then the processor performs the branch operation, according to the specified branching function.

Branching to target address by adding value selected from programmable offset table to base address specified in branch instruction

A device may receive requests intended for a memory that includes a number of banks, determine a number of the requests intended for each of the banks, determine an order for the requests based on the determined number of the requests intended for each of the banks, and send one of the requests to the memory based on the determined order.

Growing community of inventors

Mountain View, CA, United States of America

John Keen