Cisco Technology, Inc.

Martin Hughes

William Robert Lee

Trevor Garner

Sriram Haridas

Michael L Wright

John Kenneth Stacy

Dennis Briddell

Joydeep Chowdhury

John Mitten

Trevor Gamer

Hanli Zhang

Techniques for routing a payload of a first network protocol, which includes header information for a second network protocol, include communicating a packet. In a circuit block, a first type for the first network protocol and a second type for the second network protocol are determined. The circuit block stores a classification that indicates a unique combination of the first type and the second type. A general purpose processor routes the packet based on the classification. Processor clock cycles are saved that would be consumed in determining the types. Furthermore, based on the classification, the processor can store an offset value for aligning the header relative to a cache line. The circuit block can store the packet shifted by the offset value. The processor can then retrieve from memory a single cache line to receive the header, thereby saving excess loading and ejecting of cache.

Network protocol header alignment

An apparatus for routing data packets includes a network interface, a memory, a general purpose processor and a flow classifier. The memory stores a flow structure. Every packet in one flow has identical values for a set of data fields in the packet. The memory stores instruction that cause the processor to receive missing flow data and to add the missing flow to the flow structure. The apparatus forwards a packet based on the flow. The flow classifier determines a particular flow and whether it is already stored in the flow structure. If not, then the classifier determines whether that flow has already been sent to the processor as missing data. If not, then the classifier stores into a different data structure data that indicates the flow has been sent to the processor but is not yet included in the flow data structure, and sends missing data to the processor.

Apparatus for hardware-software classification of data packet flows

Method and apparatus for classifying a network protocol and aligning a network protocol header relative to cache line boundary

Techniques for initializing an arbitrary portion of memory with an arbitrary pattern includes using a memory controller for performing sequenced read and write operations. The memory controller receives address data, length data and pattern data on a data bus connected to a processor. The address data indicates a location in memory. The length data indicates an amount of memory to be initialized. The pattern data indicates a particular series of bits that is much shorter than the amount of memory indicated by the length data. The memory controller performs multiple write operations on memory beginning at a first location based on the address data and ending at a second location based on the length data. Each write operation writes the pattern data to a current location in memory, thereby initializing the arbitrary portion of memory with an arbitrary pattern based on the pattern data.

Method and apparatus for arbitrarily initializing a portion of memory

Techniques for synchronizing use of buffer descriptors for data, such as packets transmitted over a network, include receiving private index data that indicates a particular buffer descriptor owned by a DMA controller, for moving data between a data port and a corresponding memory buffer. A write command is placed on a memory exchange queue to change the owner to a different processor and the private index data is incremented. A public index is determined, which indicates a different buffer descriptor in which the owner is most recently changed to the processor and is known to be visible to the processor. In response to receiving a request from the processor for the most recent buffer descriptor changed to processor ownership, the public index data is sent to the processor. Based on the public index data, the processor exchanges data with buffer descriptors guaranteed to be owned by the processor.

Method and apparatus for synchronizing use of buffer descriptor entries for shared data packets in memory

A system and method is provided for automatically identifying and removing malicious data packets, such as denial-of-service (DoS) packets, in an intermediate network node before the packets can be forwarded to a central processing unit (CPU) in the node. The CPU's processing bandwidth is therefore not consumed identifying and removing the malicious packets from the system memory. As such, processing of the malicious packets is essentially 'off-loaded' from the CPU, thereby enabling the CPU to process non-malicious packets in a more efficient manner. Unlike prior implementations, the invention identifies malicious packets having complex encapsulations that can not be identified using traditional techniques, such as ternary content addressable memories (TCAM) or lookup tables.

Hardware filtering support for denial-of-service attacks

A technique efficiently searches a hash table containing a plurality of 'ranges.' In contrast with previous implementations, the technique performs fewer searches to locate one or more ranges stored in the hash table. To that end, the hash table is constructed so each hash-table entry is associated with a different linked list, and each linked-list entry stores, inter alia, 'signature' information and at least one pair of values defining a range associated with the signature. The technique modifies the signature based on the results of one or more preliminary range checks. As a result, the signature's associated ranges are more evenly distributed among the hash table's linked lists. Thus, the linked lists are on average shorter in length, thereby enabling faster and more efficient range searches. According to an illustrative embodiment, the technique is applied to flow-based processing implemented in an intermediate network node, such as a router.

Header range check hash circuit

A technique for managing a cache memory coupled to an intermediate node's processor. Packets acquired by the intermediate node that are destined for processing by the processor are tracked, without the processor's intervention, to determine if the processor is lagging in processing the acquired packets. If so, data associated with unprocessed packets are pre-fetched from an external memory and placed in the cache memory without the processor's intervention. Moreover, packets destined for processing by the processor and placed into the cache memory are tracked, without the processor's intervention, to determine if the processor has, in fact, completed the processing of those packets. If so, data contained in the cache memory that is associated with the processed packets are invalidated, again without the processor's intervention.

Growing community of inventors

Cary, NC, United States of America

Martin Hughes