3com Corporation

Hewlett-packard Company

Hewlett-packard Development Company, L.p.

Kevin Loughran

Daniel M O'Keeffe

Mark A Hughes

Peter Furlong

David J Law

Edele O'Malley

John F Hickey

Eugene O'Neill

Paul J Moran

Kam Choi

Sorcha O'Callaghan

Eoghan Stack

Michael Joseph Gleeson

Kevin Jennings

Vincent Gavin

Gareth Edward Allwright

Patrick Gibson

Christopher Hay

Christopher Alan Walker

Joseph N Butler

Fergus Casey

Paul O'Keeffe

David Nolan

Paul Hough

Philip Pinto

Paul Linehan

Christopher Gilbert

An apparatus including logic to receive a data packet comprising a string of characters, said apparatus having a plurality of states and at least one state for every character position in the string of characters; logic to examine the string of characters for matches with a plurality of predefined values, beginning with an initial character; and logic to execute forward exit transitions from any of the plurality of states based upon the examination of the characters, wherein a current state of the apparatus represents a count of a number of characters from the initial character of the string of characters.

Positionally dependent pattern checking in character strings using deterministic finite automata

A deterministic finite state machine organised for the detection of positionally significant matches of characters in a string of characters examines each character in turn to determine a exit transition for a current state of the machine to another state The machine responds to an examination of the string of characters by executing in response to a first character at the commencement of the string a transition from an initial state to another state. The machine has at least one state for every character position, includes a exit transition from each state for each character to another state; and possesses only forward exit transitions each from any of the states whereby the current state of the machine unambiguously represents a count of the number of characters from the commencement of the string. The machine may include at least one match state which indicates that all character matches in the string required by at least one respective rule have been detected. Some but not all the states in the multiplicity of states each have a single exit transition for any value of a respective character in the string. At least some of the states in the multiplicity of states each define an exit transition to a state indicating 'no match'. The machine may be disposed to cease its examination of the character string on attaining a 'no match'state.

A method of detecting signatures in message segments comprises employing a state machine for the detection of character strings in the message segments. The state machine executes for each input character a transition determined by a current state of the machine and a current input character. The message segments conform to TCP or other ordering transport protocol. The order of arrival of the message segments is monitored. In the event that an intermediate message segment is missing between a processed segment and an immediately subsequent message segment, the current state of said state machine at the end of the said processed segment is stored. The machine is restarted from its null or datum state for the examination of the immediately subsequent message segment, which is then temporarily stored. When the missing segment eventually arrives, it and the stored segment are successively examined for signatures by means of the state machine, beginning at the stored state. The invention allows for examination of overlapping signatures without requiring re-assembly of the segments or substantial buffering.

Detection of signatures in disordered message segments

Deciphering and verification of the checksum of enciphered and encapsulated UDP datagrams, particularly those which enclose a tunneling protocol such as L2TP, are achieved by the provision of a checksum verifier in parallel with a decipher block. Checksum logic creates a pseudo UDP header needed for checksum verification using fields that would occur at the start of the packet that encapsulates the UDP datagram. The first part of the packet to be deciphered is the UDP header; checksum logic can latch the checksum field into a local register. As the rest of the packet is deciphered the checksum verifier processes the data at the same time. Eventually the checksum logic will acquire a complete checksum which can be compared with the checksum that had been previously latched, so as to verify the checksum.

Deciphering encapsulated and enciphered UDP datagrams

The deciphering of fragmented enciphered IP packets is performed without requiring reassembly of the fragments. fragmented packets. When a first frame is deciphered a characteristic poly-tuple is saved against the state of the cipher, particularly an output vector. When the next frame comes in, the cipher would continue on from that previously saved state after a look-up of the poly-tuple. Each frame would then be sent on, deciphered, but still representing a fragment of the original packet. The poly-tuple employed for the look-up includes the identity and protocol fields from the IP header and at least one of the source IP address and the destination IP address. The deciphering process may commence with the combination of input data with an initializing vector and proceed by combining input data with a vector fed back from the output of the deciphering engine. The saved cipher state is employed as the initializing vector for the next frame.

Deciphering of fragmented enciphered data packets

A method and switch for controlling the allocation of priority of TCP packets, more particularly for distinguishing between data and control packets and assigning an increased priority to control packets. The layer 4 information in the form of the flag bits of the header are snooped in the switch to determine whether any flag other than PSH is set and if so to allocate a priority to that packet, which will usually be a higher priority than data packets.

TCP control packet differential service

For each metered flow in a network unit there is a memory entry which defines a time stamp and a rate parameter. When a packet in the respective flow arrives, the time of arrival is compared with the time stamp. If the time of arrival is before the time stamp the packet is discarded. If the packet arrives after the date stamp, it is allowed to proceed and a new time stamp is computed in accordance with the rate parameter. One exemplary computation adds to the time stamp a time interval obtained by dividing the size of the packet by the rate parameter and preferably subtracting from the quotient the time interval between the arrival time and the previous time stamp.

Packet metering in high-speed network units

A communication device which includes a hardware trie search facility. At least part of a memory is divided into memory blocks, each of said blocks consisting of a multiplicity of locations, at least some of said locations each providing when accessed a pointer to another block and an indication of the size of the block. A shift register holds an address key, and a trie block is accessed using an address composed of a number of bits related to said indication of the size of the block. The key is shifted by said number of bits prior to a subsequent stage of the search. Part of the memory comprises an associated data table which includes entries of data enabling a packet to be forwarded and at least some locations in said blocks provide when accessed a pointer to an entry in the associated data table.

Communication device with forwarding database having a trie search facility

In a stack of network units each includes a multiplicity of ports for receiving and forwarding addressed data packets and a forwarding engine which in response to address data selects at least one port for the forwarding of a data packet. A cascade connects the units and allows the transmission of a packet placed on said cascade by a unit to all the other units. Each unit is responsive to a packet received from the cascade to forward or discard the received packet according to predetermined forwarding rules. A trunk includes a respective port of each of some but not necessarily all the units. Each unit includes a 'trunk box member' register indicating which of the units has at least one port connected in the trunk When a first unit in the stack receives, at a port connected neither to the trunk nor the cascade, a packet destined for the trunk, the first unit directs that packet to a port connected to the trunk if the first unit has such a port and otherwise sends that packet to the cascade. When a second unit in the stack, having a port connected to the trunk, receives by way of the cascade from the first unit a packet destined for the trunk, the second unit determines with recourse to the forwarding rules, data identifying the first unit and the respective register whether to forward said packet to the trunk. The invention is particularly intended for use in stack-wide trunks operating according to 'local forwarding' and &lsquo;next-in-line&rsquo; rules and allows units in the stack to be omitted from direct connection to the trunk.

Stackable network unit including register for identifying trunk connection status of stacked units

A network switch comprises a multiplicity of ports for receiving and forwarding addressed data packets, a forwarding engine for directing packets received at the ports to at least one other port, a register for storing unit identifications of a set of units including the network unit, and hashing logic for selecting one of the unit identifications in response to address data in a packet. The forwarding engine makes a determination whether the one of the unit identifications corresponds to the network unit and is operative to direct the packet in accordance with that determination. The use of the register enables a substantial increase in the number of ports that can be members of a stack-wide trunk.

Stackable network unit including registers for identifying stack members and trunk ports

A trie searching technique employs entries each including a pointer to the next block in the search and a status indication and also including start and end indexes which define a selected section of the trie key identifying an entry within the block identified by the pointer. Thereby the program for selection of the search key is defined by the trie entries themselves, enabling a general variety of search selections and jumps to avoid any unnecessary parts of the trie search key.

Method and apparatus for searching databases employing a trie search structure

A sub-system for forming part of a packet-data communication system for the transmission of data packets which contain media access control addresses and protocol addresses. The sub-system comprises a multiple-port network switch for forwarding data packets in response to an examination of the packets on the basis of the packets protocol addresses, and for performing said examination when a destination address in the packet corresponds to the media access control address of the switch, the switch being arranged for forwarding a packet on the basis of a media access control address therein when the destination address of the packet does not correspond to the media access control address of the switch, said switch including a forwarding database which comprises entries which relate a protocol address with a media access control address and an identification of a particular port of the switch. This switch may perform routing within a local-area network. The switch is configured so that protocol addresses may not be learned in the database in respect of the particular port. A network router, which may perform routing functions in respect of a wide-area network, is connected to the switch only by way of the particular port. The sub-system enables the switch to off-load from the router routing functions for the local-area network.

Network switch with self-learning routing facility

An application specific integrated circuit includes a multiplicity of operational blocks each of which includes at least one respective data bus and at least one respective visibility bus and a respective addressable multiplexer for selecting between those buses to provide an output on a to respective block bus. An interface block includes a first addressable multiplexer for selecting output data from a selected one of the blocks and providing an output; a register coupled to the output of the first addressable multiplexer; and a second addressable multiplexer for selecting between data provided by the output of the first addressable multiplexer and data in the register. Different portions of externally supplied address words are applied to the first addressable multiplexer and the respective addressable multiplexer, and a decoder is responsive to the address words for controlling the second addressable multiplexer. The arrangement provides a common multiplexing system for data buses and visibility buses.

Application specific integrated circuit with dual-mode system for externally accessible data buses and visibility buses

A network switch including a port for the reception and transmission of data packets, and a receive buffer store connected to the port, detecting a predetermined state of fullness of the buffer store, initiating in response to the state of fullness the production of control frames for signaling to a source of packets to pause the sending of packets to the switch, counting said frames to obtain a measure of congestion of the switch, and responsive to a rate of change of measure to enable the discarding of packets received by the buffer when rate is higher than a first predetermined value and to disable the discarding of packets when the rate of change of the measure is below a second predetermined value.

System and method for congestion control in packet-based communication networks

A network switch including a multiplicity of ports for the reception and forwarding of addressed data packets including network destination data and network source address data, and a forwarding database having a trie search facility organised in blocks of pointers, which are accessed by respective segments of a search key and identify in a last stage of a search forwarding data identifying each port from which a packet should be forwarded and in any stage of the search prior to the last stage a block of pointers, the switch including a device operable before the trie search facility is utilised for a given packet to compare a network destination address of the given packet with at least one stored address and when the network destination address matches the stored address to access the network source address data of the given packet for use as the search key.

Growing community of inventors

Castleblayney, Ireland

Kevin Loughran