Marvell Israel (misl) Ltd.

Marvell International Limited

Maxim Mondaeev

Yosef Meyouhas

Donald Robert Pannell

Peter Wang

Tal Anker

Tsahi Daniel

Nir Haim Arad

A method for processing packets in a network device includes receiving a packet at the network device, identifying a flow with which the packet is associated, and, based at least in part on the identified flow, selectively causing the packet, or a packet descriptor associated with the packet, to bypass at least a first packet processing unit of the network device.

Method and apparatus for deep packet inspection for network intrusion detection

A network interface controller comprising a first media access controller, a header decoder, a second media access controller. The first media access controller is configured to receive, from a first port, a frame of data transferred from one of a plurality of second ports, wherein the frame of data includes a first steering header identifying the one of the plurality of second ports. The header decoder is configured to transfer the frame of data to a memory based on the first steering header. The second media access controller is configured to receive the frame of data from the memory based on the first steering header, and transmit the frame of data, with a second steering header, from the network interface controller to a destination port based on the second steering header.

Method and apparatus for transferring a frame of data from a first network to a second network

In a method of determining whether a data stream includes unauthorized data, the data stream is analyzed using a hardware filter to detect a presence of one or more of a first set of patterns in the data stream. It is determined whether a packet in the data stream belongs to one of a plurality of data flows to be further inspected based on the analysis of the data stream by the hardware filter. A set of rules is applied to the packet to produce rule match status data if it is determined that the packet belongs to one of the plurality of data flows to be further inspected. The packet is analyzed to determine if the packet includes unauthorized data using software stored on a computer-readable medium and implemented on a processor if the rule match status data indicates that the packet potentially includes unauthorized data.

A method and apparatus for transferring a frame of data from a first network to a second network. The method includes adding a first steering header to a frame of data received by a first port that is destined for the second network. The method further includes selecting a first receive queue of a plurality of receive queues based on one or more of (i) a database number, (ii) a priority bit, and (iii) a source port identifier of the first steering header; loading the frame of data into the first receive queue; and replacing the first steering header with a second steering header. The second steering header comprises the database number and a virtual local area network table vector. The method further includes determining the second port as a destination port for the frame of data based on the database number and the virtual local area network table vector.

A search engine includes a storage module to store a plurality of data patterns, a plurality of busses to receive a plurality of representations of a search word, a selector corresponding to at least one of the plurality of data patterns to select one of the plurality of representations of the search word for comparing to the at least one of the plurality of data patterns, and a logic circuit operatively coupled to the storage module, to the plurality of busses, and to the selector to compare the selected one of the plurality of representations of the search word to the at least one of the plurality of data patterns.

Comparing data representations to stored patterns

An embodiment of the present invention offloads the generation and monitoring of test packets from a Central processing Unit (CPU) to a dedicated network integrated circuit, such as a router, bridge or switch chip associated with the CPU. The CPU may download test routines and test data to the network IC, which then generates the test packets, identifies and handles received test packets, collects test statistics, and performs other test functions all without loading the CPU. The CPU may be notified when certain events occur, such as when throughput or jitter thresholds for the network are exceeded.

Hardware implementation of network testing and performance monitoring in a network device

In a method for detecting patterns, a plurality of data patterns is stored in a memory, and a data block from a stream of data is received. A first subset of the data block is compared in parallel to the plurality of data patterns. A second subset of the data block is compared in parallel to the plurality of data patterns, wherein the second subset partially overlaps the first subset. At least one signal is generated that indicates a detected data pattern in the data block.

Apparatus to detect patterns in data

A network device comprises one or more first ports to receive at least one layer 2 frame of data comprising a media access control (MAC) client data field. An egress policy module adds M bits to the frame of data before the MAC client data field, where M is an integer greater than zero. A second port transmits the frame of data after the M bits are added to the frame of data.

Router having a single CPU MAC

A network device for transferring data from a first network to a second network comprises a switch comprising a first port adapted to receive a frame of the data from the first network and a second port adapted to transmit the frame to the second network. The frame comprises a plurality of words including a first word comprising a first portion of an internet protocol address and a second word comprising a second portion of the internet protocol address. The switch adds one or more bits to the frame so that the first and second portions of the internet protocol address appear within a single word of the frame. A processor receives the frame from the switch, and to modify the internet protocol address in the frame. The switch receives the frame from the processor, and removes the one or more bits from the frame before the second port transmits the frame to the second network.

A network device, and corresponding method and computer program, comprises a plurality of ports; wherein one of the ports is configured to receive frames of data each comprising a steering header comprising a flooding mask that identifies one or more of the ports, and a management bit that when set indicates the frame of data is a management frame; wherein, for each frame received by the one of the ports, the one of the ports removes the steering header from the frame and, when the management bit is set, identifies the frame as a management frame and directs the frame to one or more of the ports based only on the flooding mask; and wherein each of the ports can operate in a blocked state that permits only frames of data identified as management frames to pass through the port.

Network switch using a steering header for management frames

A method, apparatus, and computer-readable media for transferring data from a first network to a second network through a network device, comprising. It comprises receiving a frame of the data from the first network, the frame comprising an internet protocol address; transmitting the frame to a media access controller of the network device; transmitting the frame from the media access controller to a processor of the network device, wherein the processor modifies the internet protocol address; transmitting the frame from the processor to the media access controller; and transmitting the frame from the media access controller to the second network.

A router comprises a processor, a single media access controller connected to the processor; and a switch comprising a plurality of ports, wherein one of the ports is connected to the single media access controller.

Growing community of inventors

Givat-Ela, Israel

Maxim Mondaeev