Vmware, Inc.

Pensando Systems Inc.

Hewlett-packard Development Company, L.p.

Maruthi Ram Namburu

Pirabhu Raman

Balakrishnan Raman

Varun Lakkur Ambaji Rao

Vijay Sampath

Srinivasa Srikanth Podila

John Cruz

Shaik Nazeer

Krishna Doddapaneni

Vipin Jain

Varagur Chandrasekaran

Sarat Kamisetty

Mahesh Mylarappa

Venkataraman Kamalaksha

Akshaya Nadahalli

Akshay Nadahalli

Chandrasekaran Swaminathan

Synchronizing the databases maintained by network appliances can support high availability or high throughput topologies, but also consumes the devices' processing resources. To address that resource consumption, the network appliance's packet processing pipeline circuits can process synchronization packets to thereby synchronize the databases. A local data structure can be in a first local state. Processing a network packet can result in changing the local data structure to a second local state. A state sync packet can include state transition data that indicates a state difference between the first local state and the second local state. The state sync packet can be sent to a peer device that is configured to process the state transition data using the peer device's packet processing pipeline circuit. The peer device's packet processing pipeline can use the state transition data to update a peer device data structure that is in the peer device.

Methods and systems for distributed high speed state synchronization

Network traffic flows can be processed by routers, switches, or service nodes. Service nodes may be ASICs that can provide the functionality of a switch or a router. Service nodes can be configured in a circular replication chain, thereby providing benefits such as high reliability. The service nodes can implement methods that include receiving a first packet that includes a source address in a source address field and that includes a destination address in a destination address field, routing the first packet to a selected service node that is in a circular replication chain that includes a plurality of service nodes that have local flow tables and are configured for chain replication of the local flow tables, producing a second packet by using a matching flow table entry of the first packet to process the first packet, and sending the second packet toward a destination indicated by the destination address.

Methods and systems for service state replication using original data packets

Some embodiments provide a novel method for performing network address translation to share a limited number of external source network addresses among a large number of connections. Instead of allocating an external source network address for an egressing packet just based on its internal source network address, the method of some embodiments allocates the external source network address based on the egressing packet's source network address and destination network address. This allows a limited number of external source network addresses to be re-used for different destination network address. For instance, in some embodiments, the method's network address allocation scheme allows the same 64K (e.g., 2{circumflex over (&#x2003;)}16) external source ports to be used for 64K connections for each destination network address.

Connection tracking records for a very large scale NAT engine

Pre-allocating port groups for a very large scale NAT engine

A method of controlling protection of a computing device or computer network. The method comprises directing incoming data packets to the computing device or computer network via a rate limiting system that is adapted to parse the data packets, providing the computing device or computer network with at least one threshold parameter for identifying a data flood condition, the threshold parameter being a function of one or more available computing resources of the computing device or computer network; the computing device or computer network responding to incoming data packets received via the rate limiting system that cause the at least one threshold parameter to be breached by generating event data; generating feedback data based on the event data; transmitting the feedback data to the rate limiting system; and the rate limiting system modifying its behavour according to the feedback data.

Method and system for protecting a computer network against packet floods

Growing community of inventors

Bengaluru, India

Maruthi Ram Namburu