Cisco Technology, Inc.

Monica Dattatraya Joshi

Pauline Shuen

Hyesook Lim

Kevin Roy McMenamy

Troy H Sherman

David Michael Thornburg

Bradley Neil Dunsmore

Salah Nassar

Philip Ngai

Systems and methods perform analysis of ICMP packets received at a network device port to determine if the ICMP packet is valid and thus should be forwarded. One aspect of the systems and methods includes configuring a port to be a trusted port in which any type of ICMP message may be considered valid. For untrusted ports, the system analyzes the ICMP packet to determine if the packet is one that should be received on an untrusted port. A further aspect of the systems and methods includes analyzing the ICMP packet data to determine if packet addresses have been spoofed or altered.

Systems and methods for access port ICMP analysis

This invention provides for an apparatus and method to isolate ports on layer 2 switches on the same VLAN to restrict traffic flow. The apparatus comprises a switch having said plurality of ports, each port configured as a protected port or a non-protected port. An address table memory stores an address table having a destination address and port number pair. A forwarding map generator generates a forwarding map which is responsive to a destination address of a data packet. The method for isolating ports on a layer 2 switch comprises configuring each of the ports on the layer 2 switch as a protected port or a non-protected port. A destination address on an data packet is matched with a physical address on said layer 2 switch and a forwarding map is generated for the data packet based upon the destination address on the data packet. The data packet is then sent to the plurality of ports pursuant to the forwarding map generated based upon whether the ingress port was configured as a protected or nonprotected port.

Port isolation for restricting traffic flow on layer 2 switches

Disclosed are, inter alia, methods, apparatus, data structures, computer-readable medium, mechanisms, and means for merging indications of matching items of multiple groups and possibly associated with skip conditions to identify winning entries of particular use for implementing access control lists. Indications are received typically from an associative memory bank indicating which locations were matched during a lookup operation. Each of the entries is typically associated with one or more hierarchical groups and a skip or no-skip condition. The matching entries are merged to identify one or more wining entries, these being matching entries not in a group that is skipped. A group is typically skipped if the highest priority matching entry of the particular group is associated with a skip condition. A priority encoder can be used to identify a single highest priority winning entry from the winning entries.

Merging indications of matching items of multiple groups and possibly associated with skip conditions to identify winning entries of particular use for implementing access control lists

Growing community of inventors

San Jose, CA, United States of America

Monica Dattatraya Joshi