Cisco Technology, Inc.

Pensando Systems Inc.

Pirabhu Raman

Sanjay Sane

Krishna Doddapaneni

Sarat Kamisetty

Sameer Merchant

Balakrishnan Raman

Vipin Jain

Umamaheswararao Karyampudi

Murukanandam Kamalam Panchalingam

Vijay Sampath

Navindra Yadav

Amit Jain

Kalyan Ghosh

Shrey Ajmera

Maruthi Ram Namburu

Enrico Schiattarella

Akshaya Nadahalli

John Cruz

Dinesh Ganapathy Dutt

Umesh Mahajan

Varagur Chandrasekaran

Raghava Kodigenahalli Sivaramu

Subbarao Arumilli

Smita Rai

Mahesh Srinivasa Maddury

Karthikeyan Sabhanatarajan

Hariharan Balasubramanian

Prabu Thayalan

Paul Mathison

Vijay Rangarajan

Bharat Kumar Bandaru

Sameer Kittur Subrahmanya

Harish Manoharan

Ray Kloth

Tuyen Van Quoc

J Bradley Smith

Pavithra Ramaswamy

Hareesh Ramachandran

Ramprasad Nagaraja Rao

Rathina Sabapathy Sabesan

Dontula Venkata Ratnananda Ganesh

Deepak Cherian

Yuan-Chi Ma

Man-Yee Hau

Mohankumar R Tiruvayapadi

Chandrasekaran Swaminathan

Akshay Nadahalli

Santosh Golecha

A networking device can include a packet processing pipeline circuit and a processor. The packet processing pipeline circuit can be configured to implement a data plane and the processor can be configured to implement a control plane. The packet processing pipeline circuit and the processor can also be configured to send a plurality of heartbeat packets on multiple paths to a second networking device. The data plane can produce and send the heartbeat packets to the second networking device within a heartbeat period. The data plane may send a second plurality of heartbeat packets on multiple paths to the second networking device with a second heartbeat period. The heartbeat packets can have unique packet five tuples that include an IP address of the second networking device.

Systems and methods for a networking device to send heartbeat packets on multiple paths to a second networking device

Network appliances can record log entries in log objects. An object store can receive the log objects and can use the log objects to create index objects and flow log objects. Each flow log object and index object can be associated with a time period wherein the flow log object includes flow log entries received during that time period. The index object includes shard tables that can be stored in different nonvolatile memories and can thereby be concurrently searched. Shard entries in the shard tables indicate flow entry indicators. The flow entry indicators indicate log entries in the flow log object. An internally indexed searchable object can include the flow log object and the index object. Numerous indexed fields in the flow log entries and can be indexed with each indexed field searchable via the shard entries.

Methods and systems for flow logs using an internally indexed searchable object

HA peers can include networking devices that have data planes and control planes that configure the data plane to use status data in a memory for processing network packets of network flows. The HA peers synchronize the status data such that one peer can take over when another fails. When a HA peer is brought up, data plane syncing synchronizes data for new network flows but not existing network flows. A first bulk sync operation synchronizes data for existing flows but not for new flows. A second bulk sync operation can synchronize the data for flows that changed state during the first bulk sync operation. Data plane syncing can sync data for all flows after the first bulk sync operation.

Systems and methods for high availability node pairing without incurring connection drops

Synchronizing the databases maintained by network appliances can support high availability or high throughput topologies, but also consumes the devices' processing resources. To address that resource consumption, the network appliance's packet processing pipeline circuits can process synchronization packets to thereby synchronize the databases. A local data structure can be in a first local state. Processing a network packet can result in changing the local data structure to a second local state. A state sync packet can include state transition data that indicates a state difference between the first local state and the second local state. The state sync packet can be sent to a peer device that is configured to process the state transition data using the peer device's packet processing pipeline circuit. The peer device's packet processing pipeline can use the state transition data to update a peer device data structure that is in the peer device.

Methods and systems for distributed high speed state synchronization

Network traffic flows can be processed by routers, switches, or service nodes. Service nodes may be ASICs that can provide the functionality of a switch or a router. Service nodes can be configured in a circular replication chain, thereby providing benefits such as high reliability. The service nodes can implement methods that include receiving a first packet that includes a source address in a source address field and that includes a destination address in a destination address field, routing the first packet to a selected service node that is in a circular replication chain that includes a plurality of service nodes that have local flow tables and are configured for chain replication of the local flow tables, producing a second packet by using a matching flow table entry of the first packet to process the first packet, and sending the second packet toward a destination indicated by the destination address.

Methods and systems for service state replication using original data packets

Methods and systems for a network flow log database

Described are platforms, systems, and methods for processing a chain of operations through an input output (IO) subsystem without central processing unit (CPU) involvement. In one aspect, a computer-implemented method comprises: providing, via the CPU, the chain of operations to the IO subsystem, wherein the IO subsystem is coupled to the one or more processors over Peripheral Component Interconnect Express (PCIe); processing, with the IO subsystem, the chain of operations by: retrieving, from a memory, data associated with the chain of operations; executing each of the operations in the chain to determine an output based on the data and output determined for any prior executed operation in the chain; and providing the output of each the executed operations for execution of the respective next operation in the chain; and providing, via the IO subsystem, an output for the chain of operations to the CPU.

Flexible datapath offload chaining

A network appliance can queue a first packet and a second packet of a network traffic flow in an input queue of a match-action pipeline. The match-action pipeline can be implemented via a packet processing circuit of the network appliance and can be configured to process a plurality of network traffic flows. Submitting the first packet to the match-action pipeline can cause a first flow miss. The second packet can be moved to a burst queue of the network appliance and a match-action configuration can be generated based on the first packet. The second packet can be moved from the burst queue to the input queue after the match-action pipeline is configured with the match-action configuration. The match-action pipeline can then process the second packet.

Flow table programming using flow miss metadata and burst action assist via CPU offload

Described are programmable IO devices installed on a host device and configured to execute instructions that cause the programmable IO device to perform operations to establish a virtual link between another programmable IO device installed on the host device and provide a data plane using the virtual link. These operations comprise: establishing the virtual link with the other programmable IO device installed on the host device, wherein the virtual link provides a communication channel between the programmable IO devices; providing the data plane by establishing, with the other programmable IO device via the virtual link, a data path associated with the data plane; receiving a packet in the data plane destined for the other programmable IO device; and forwarding the packet to the other programmable IO device via the virtual link.

Inter-smartNIC virtual-link for control and datapath connectivity

Disclosed are systems, methods, and computer-readable storage media for guaranteeing symmetric bi-directional policy based redirect of traffic flows. A first switch connected to a first endpoint can receive a first data packet transmitted by the first endpoint to a second endpoint connected to a second switch. The first switch can enforce an ingress data policy to the first data packet by applying a hashing algorithm to a Source Internet Protocol (SIP) value and a Destination Internet Protocol (DIP) value of the first data packet, resulting in a hash value of the first data packet. The first switch can then route the first data packet to a first service node based on the hash value of the first data packet.

Symmetric bi-directional policy based redirect of traffic flows

Systems, methods, and computer-readable storage media for executing a copy service. A copy service engine can monitoring network data flow in a network, detect packet data containing a contract defining copy parameters for the execution of a copy service, and determine, based on the contract, when the particular data flow hits a particular network node specified in the contract parameters. When the data flow hits the specified node, the copy service engine can execute the copy service which copies the particular data flow, determines one or more endpoints for sending the copied data flow, and deploys the copies to the one or more endpoints.

Contract-defined execution of copy service

An administrator can define or modify one or more service graphs. Next, the administrator can register service appliances along with their device package files with a controller. Then, the controller can establish the capabilities of the service devices, and classify the service devices as legacy or service tag switching (STS) capable devices. Then, the controller can create one or more instances of the service graph, by populating the service nodes into the service graph. Then, the application owner can attach their endpoint groups (EPGs) to the service graphs created by the administrator. Then, a service in the network can be automatically provisioned using the service graph to configure one or more nodes in an associated service chain of the service according to information in the service graph.

Provisioning services in legacy mode in a data center network

Techniques are provided to prevent switches in a data center fabric path environment with fabric path extension devices from media access control (MAC) address flooding and MAC address table overflow. In such an environment, endpoints associated with virtual port channels are connected to multiple switches which normally would perform MAC address flooding across all switch forwarding engines. The switches in the fabric path exchange MAC synchronization messages based on source/destination specific connectivity such that MAC broadcast messages that advertise source/destination MAC addresses for endpoints do not have to be repeatedly sent and their corresponding MAC lookup tables do not have to be updated or include unnecessary MAC table entries.

Scalable media access control protocol synchronization techniques for fabric extender based emulated switch deployments

Growing community of inventors

San Jose, CA, United States of America

Pirabhu Raman