International Business Machines Corporation

Globalfoundries Inc.

Joseph Allen Kirscht

Elizabeth A McGlone

Philip Rogers Hillier, Iii

Bruce Marshall Walk

Herman Lee Blackmon

Claude Basso

Natarajan Vaidhyanathan

David Alan Shedivy

William Thomas Flynn

Ryan Scott Haraden

Brian David Allison

Colin Beaton Verrilli

Brian Thomas Vanderpool

Todd Alan Greenfield

H Lee Blackmon

William Paul Hovis

Josep Cors

Wayne Melvin Barrett

Venkatesh K Janakiraman

John Michael Borkenhagen

Barry Alan Kritt

Sumeet Kochar

Scott Douglas Clark

Michel Poret

James Anthony Marcella

Ethan M Spiegel

William Bradley Schwartz

Ronald Ernest Freking

Sudhir Dhawan

Duane Arlyn Averill

Jamie Randall Kuesel

Shiva R Dasari

Paul William Rudrud

Randolph Scot Kolvick

Jennifer Lane Vargus

Randall Scott Jensen

Mark G Veldhuizen

Jeb A Shookman

Elizabeth Mcglone

Embodiments provide a TCAM-based access control list that supports disjunction operations in rules. A network frame is received. Embodiments determine set TCP flags of the network frame. Upon determining that the set TCP flags match a first entry in a numeric range table, bits of a search key corresponding to the first entry are updated. The search key accesses a second entry stored in a TCAM. The first entry further comprises an encode field to scan a TCP header of the network frame for set TCP flags, a first mask field to a condition corresponding to unset TCP flags to identify in the network frame, a second mask field to a condition corresponding to set TCP flags to identify in the network frame, and an operation field specifying a disjunction operation for comparing the set TCP flags with the first mask field and the second mask field.

Supporting access control list rules that apply to TCP segments belonging to 'established' connection

Embodiments presented herein provide a TCAM-based access control list that supports disjunction operations in rules. According to one embodiment, a numeric range table is tied to the access control list. Each entry in the numeric range table includes an encode field that provides for scanning TCP flags in a TCP header of an incoming Ethernet frame. Further, each entry provides a first mask and a second mask used to test for desired set and unset TCP flags in a given frame. Each entry also provides an operation field that performs a disjunction operation that compares the first mask, the second mask, and set TCP flags in a given frame.

Embodiments presented herein describe techniques for isolating multicast and broadcast frames to a traffic class that is separate from a traffic class used for unicast frames. According to one embodiment, a network switch receives an incoming Ethernet virtual local area network (VLAN)-tagged frame. The switch evaluates priority bits of the VLAN tag of the frame. The switch also determines a type of frame (e.g., whether the frame is unicast, broadcast, multicast, or flood). Based on the priority field values and the type of the frame, the switch identifies a mapping of the frame to a particular traffic class. The network switch assigns the frame to the traffic class.

Unified framework for isolating multicast and broadcast frames to a traffic class separate from a traffic class used for unicast frames

Embodiments presented herein describe techniques for selecting incoming network frames to be mirrored using an access control list. According to one embodiment, an incoming frame is received. Upon determining that the incoming frame matches an entry in the access control list, a mirror field of the entry is evaluated. The mirror field identifies at least one mirroring action to perform on the frame. The identified mirroring action is performed on the frame.

Access control list-based port mirroring techniques

Techniques are provided for retrieving entries from a routing table or a forwarding database in a distributed network switch. The forwarding database includes match and mask registers used to compare routing entries and return matching routing entries to a requesting management controller. The forwarding database uses a separate timeout value associated with the forwarding database to avoid timeout errors for general register operations, and allows for an asynchronous dump operation of routing entries.

Smart dumping of network switch forwarding database

Embodiments described herein provide techniques for atomically updating a ternary content addressable memory (TCAM)-based access control list (ACL). According to one embodiment, a current version bit of the ACL is determined. The current version bit indicates that a rule in the ACL is active is the version flag in the rule matches the current version bit. Through these techniques, a first set of rules can be modified to create a second set of rules (e.g., by insertions, deletions, and replacements, etc.).

Atomically updating ternary content addressable memory-based access control lists

Techniques for transmitting a packet from a source switch module to a destination switch module. Embodiments receive, at a first port of a first switch module, a packet that includes (i) path information specifying a route to the destination switch module, (ii) a set of load/store operations to be executed by the destination switch module and (iii) return path information specifying a route from the destination switch module to the source switch module. Upon determining that the first switch module is the destination switch module, the set of load/store operations are copied from the received packet into an execution buffer for automatic execution. Once the set of load/store operations are executed, embodiments transmit the packet to a second switch module using the first port on which the packet was received.

Directed route load/store packets for distributed switch initialization

Techniques for transmitting a packet from a source switch module to a destination switch module. Embodiments receive, at a first port of a first switch module, a packet that includes (i) path information specifying a route to the destination switch module and (ii) a set of load/store operations to be executed by the destination switch module. An indication of the first port is inserted into a return path information portion of the received packet. Upon determining that the first switch module is not the destination switch module, embodiments transmit the packet to a second switch module using a second port, the second port specified in the path information of the received packet, wherein the destination switch module is configured, upon receiving the packet, to copy the set of load/store operations into an execution buffer to be automatically executed.

Techniques are described for transmitting a packet from a source switch module to a destination switch module. Embodiments include determining, at the destination switch module, a path from the source switch module to the destination switch module. Path information specifying the determined path from the source switch module to the destination switch module is transmitted from the destination switch module to the source switch module. Additionally, embodiments include receiving, at the destination switch module, from the source switch module, a packet that includes (i) at least a portion of the path information and (ii) payload data to be processed at the destination switch module, wherein the packet was routed using the at least a portion of the path information. The payload data within the received packet is processing by the destination switch module.

Growing community of inventors

Rochester, MN, United States of America

Joseph Allen Kirscht