Cisco Technology, Inc.

Pensando Systems Inc.

Krishna Doddapaneni

Kit Chiu Chu

Sarat Kamisetty

Navindra Yadav

Thomas James Edsall

Satyam Sinha

Francisco M Matus

Sameer Merchant

Ajay Kumar Modi

Balakrishnan Raman

Pirabhu Raman

Smita Rai

Luca Cafiero

John Cruz

Hareesh Ramachandran

Michael R Smith

Silvano Gai

Ayaskant Pani

Michael Brian Galles

Azeem Suleman

Ajeer Salil Pudiyapura

Mario Mazzola

Prabu Thayalan

Sanjay Thyamagundalu

Vijay Sampath

Sameer Kittur Subrahmanya

Akshaya Nadahalli

Loganathan Nallusamy

Dontula Venkata Ratnananda Ganesh

Vijay Srinivasan

Rathina Sabapathy Sabesan

Raghava Kodigenahalli Sivaramu

Rohit Puri

Pauline Shuen

Nalinaksh Pai

Sarang M Dharmapurikar

Ravikanth Nasika

Harinadh Nagulapalli

Murty Subba Rama Chandra Kotha

Chaitanya Kodeboyina

Parag Dattatraya Bhide

Ravindra Nandalal Rathi

Igino C Cafiero

Ramanan Vaidyanathan

Chaitanya Huilgol

Maruthi Ram Namburu

Ganlin Wu

Alok Rathore

Varada Raja Kumar Kari

Bharat Kumar Bandaru

Allen Hubbe

J Bradley Smith

Jialin Song

Francis Matus

Barun Halder

Bharat Bandaru

Arun Selvarajan

Ravi Raju

Jalajadevi Ganapathy

Aubin Sanyal

Pavan Ramakrishnaiah

Kalyan Bade

Karthi Mohanraj

Jr Rivers

Chandrasekaran Swaminathan

Akshay Nadahalli

Sarat Babu Kamisetty

A networking device can use sync request packets to synchronize connection objects with a peer. Real or virtual flow misses occurring in the data plane while processing a network packet indicate that synchronization is needed. A virtual flow miss occurs when a data plane connection object is obsolete. A sync request packet containing connection metadata and the network packets is sent to the peer. The peer uses the connection metadata to create or update its version of the connection object then returns a sync ack packet that contains the network packet. Receiving a sync ack packet can indicate that the locally stored version of the connection object and the peer's version of the connection object are consistent. The network packet may be processed normally when the locally stored version of the connection object and the peer's version of the connection object are consistent.

Systems and methods for flow configuration syncing between network infrastructure devices

An orchestrator can send trace directives to network appliances that indicate a network flow to trace. The network appliances can include packet processing pipelines that each include numerous processing stages. The network appliances implement network rules for processing network flows by configuring the pipeline's processing stages to execute specific policies for specific network packets in accordance with the network rules. The processing stages can also be configured to produce metadata indicating the policies implemented at each stage to process certain network packets in network flows indicated by trace directives. The metadata can be used to produce a trace report that indicates a network packet of the network flow, a first network rule that was applied to the network packet by a one of the first appliance processing stages, and the one of the first appliance processing stages that applied the first network rule to the network packet.

Methods and systems for orchestrating network flow tracing within packet processing pipelines across multiple network appliances

SR-IOV (single root IO virtualization) capable PCIe devices can implement virtual functions (VFs) that are assigned to VMs running on a host machine, thereby speeding IO operation by writing directly to the VMs' memory while bypassing the hypervisor managing the VMs. As such, VFs thwart the dirty page tracking that hypervisors use to minimize VM downtime when the VM is migrated between hosts. The SR-IOV PCIe devices can help resolve this problem by maintaining dirty page tracking data for VMs running on the host machine. The SR-IOV PCIe devices bypassing the hypervisor while writing into a memory page of the VM can set the dirty page tracking data to indicate the memory pages that are dirty (i.e., written to by the VF), and can provide access to the dirty page tracking data. The hypervisor can thereby obtain and use the dirty page tracking data.

Methods and systems for using a peripheral device to assist virtual machine IO memory access tracking

Described are method, devices, and systems for establishing a forwarding state for a data flow in a provided datapath by receiving a packet from the data flow that is not installed in the datapath; allocating a flow queue for the data flow; processing the packet to determine a flow entry for the data flow; queueing any subsequently received packets from the data flow to the flow queue until the flow entry is set to the forwarding state; reinjecting the packet into the datapath; dequeuing the flow queue to reinject each of the subsequently received packets into the datapath; forwarding the packet and each of the subsequently received packets to a port associated with the data flow; and updating the flow entry to the forwarding state once the flow queue is emptied.

Systems and methods to prevent packet reordering when establishing a flow entry

A networking device can include a packet processing pipeline circuit and a processor. The packet processing pipeline circuit can be configured to implement a data plane and the processor can be configured to implement a control plane. The packet processing pipeline circuit and the processor can also be configured to send a plurality of heartbeat packets on multiple paths to a second networking device. The data plane can produce and send the heartbeat packets to the second networking device within a heartbeat period. The data plane may send a second plurality of heartbeat packets on multiple paths to the second networking device with a second heartbeat period. The heartbeat packets can have unique packet five tuples that include an IP address of the second networking device.

Systems and methods for a networking device to send heartbeat packets on multiple paths to a second networking device

Disclosed is a method for continuous in-line monitoring of data-centric traffic to guarantee application performance. The method includes, in each switch of a plurality of switches in a network fabric, grouping all packets entering each respective switch of the plurality of switches based on either 5-tuple applications or EPG based applications, collecting performance statistics at every hop in the network fabric across all flows in-line in a flow table maintained in each respective switch and periodically exporting the performance statistics to analysis module.

System and method for continuous in-line monitoring of data-center traffic

A network appliance or smart switch can include service devices as well as a switching device such as those used in high-speed switches having limited processing ability and are stateless with respect to sessions. Service devices can provide stateful and complex processing. A first exposed port of a switching device can receive network packets and can determine which network packets the service devices are to process to produce processed network packets. A network packet can be sent to a service device in a redirected packet. A processed network packet can be received from a service device in a reinjected packet that is used to recover a port identifier of the first exposed port. The port identifier can be used to determine a network destination of the processed network packet. The processed network packet can be sent from a second exposed port of the switching device toward the network destination.

Methods and systems for processing network packets using a service device in a smart switch

A network appliance can continue operation at a degraded level during an upgrade that requires less free pipeline memory than other upgrade techniques. The network appliance has a control plane and has a data plane with a packet processing pipeline circuit. Before the upgrade, the control plane has configured the packet processing pipeline circuit to process a network flow. The packet processing pipeline may be halted in order to perform a pipeline upgrade during which the packet processing pipeline circuit's pipeline memory is cleared. The packet processing pipeline circuit is restarted after the pipeline upgrade after which the control plane can reconfigure the packet processing pipeline circuit to process the network flow. The packet processing pipeline circuit can therefore process the network flow after the pipeline upgrade.

Methods and systems for upgrading a control plane and a data plane of a network appliance

HA peers can include networking devices that have data planes and control planes that configure the data plane to use status data in a memory for processing network packets of network flows. The HA peers synchronize the status data such that one peer can take over when another fails. When a HA peer is brought up, data plane syncing synchronizes data for new network flows but not existing network flows. A first bulk sync operation synchronizes data for existing flows but not for new flows. A second bulk sync operation can synchronize the data for flows that changed state during the first bulk sync operation. Data plane syncing can sync data for all flows after the first bulk sync operation.

Systems and methods for high availability node pairing without incurring connection drops

Network traffic flows can be processed by routers, switches, or service nodes. Service nodes may be ASICs that can provide the functionality of a switch or a router. Service nodes can be configured in a circular replication chain, thereby providing benefits such as high reliability. The service nodes can implement methods that include receiving a first packet that includes a source address in a source address field and that includes a destination address in a destination address field, routing the first packet to a selected service node that is in a circular replication chain that includes a plurality of service nodes that have local flow tables and are configured for chain replication of the local flow tables, producing a second packet by using a matching flow table entry of the first packet to process the first packet, and sending the second packet toward a destination indicated by the destination address.

Methods and systems for service state replication using original data packets

PCIe devices installed in host computers communicating with service nodes can provide virtualized NVMe over fabric services. A workload on the host computer can submit an SQE on a NVMe SQ. The PCI device can read the SQE to obtain a command identifier, an OpCode, and a namespace identifier (NSID). The SQE can be used to produce a LTP packet that includes the opcode, the NSID, and a request identifier. The LTP packet can be sent to the service node, which may access a SAN in accordance with the opcode and NSID, and can respond to the LTP with a second LTP that includes the request identifier and a status indicator. The PCI device can use the status indicator and the request identifier to produce a CQE that is placed on a NVMe CQ associated with the SQ.

Methods and systems for providing a virtualized NVMe over fabric service

Network traffic flows can be processed by routers, switches, or service nodes. Service nodes may be ASICs that can provide the functionality of a switch or a router. Service nodes can be configured in a circular replication chain, thereby providing benefits such as high reliability. The service nodes can implement methods that include receiving a first packet that includes a source address in a source address field and that includes a destination address in a destination address field. The first packet can be routed to a selected service node that is in the replication chain that includes a plurality of service nodes that are configured for chain replication of a service state information. A service node configured for NAT or some other service can use the first packet to produce a translated packet that can be transmitted toward a destination indicated by the destination address.

Methods and systems for service distribution using data path state replication and intermediate device mapping

Network appliances can use packet processing pipeline circuits to implement network rules for processing network packet flows by configuring the pipeline's processing stages to execute specific policies for specific network packets in accordance with the network rules. Trace reports that indicate network rules implemented at specific processing stages can be more informative than those indicating policies implemented by the processing stages. A method implemented by a network appliance can store network rules for processing network flows by the processing stages of a packet processing pipeline circuit. The method can produce a trace report in response to receiving a trace directive for one of the network flows wherein one of the processing stages has applied a network rule to a network packet in one of the network flows. The trace report can indicate the network rule in association with the processing stage and the network flow.

Methods and systems for network flow tracing within a packet processing pipeline

The subject technology addresses a need for improving utilization of network bandwidth in a multicast network environment. More specifically, the disclosed technology provides solutions for extending multipathing to tenant multicast traffic in an overlay network, which enables greater bandwidth utilization for multicast traffic. In some aspects, nodes in the overlay network can be connected by virtual or logical links, each of which corresponds to a path, perhaps through many physical links, in the underlying network.

Multicast multipathing in an overlay network

Growing community of inventors

Cupertino, CA, United States of America

Krishna Doddapaneni