Cisco Technology, Inc.

Avago Technologies International Sales Pte. Limited

Rajan Sharma

Mandar S Joshi

Mark Birman

Christophe Joly

Niranjan Vaidya

Laxminarasimha Rao Kesiraju

Abhay Kumar Kulkarni

Mosi Ravia

Vamsi Tatapudi

Oron Levi

Ramanan Raghuraman

In some aspects, the disclosure is directed to methods and systems for providing an architecture for building high performance silicon components that support a rich set of networking and security features. In many implementations, the architecture splits network and security functions into two functional and logical blocks (which may physically be on the same die or integrated circuit in some implementations, or may be split on separate integrated circuits). The network functions may be executed via an integrated network interface card and accelerator subsystem with a high throughput execution pipeline. Security functions may be executed asynchronously from the network processing functions, in many implementations.

High performance architecture for converged security systems and appliances

A switch includes memory including a flow table. The flow table includes a flow key database and a flow policy database for flows in a network associated with the switch. The switch includes a security processor including an exact match engine. The exact match engine manages the flow table in the memory. The exact match engine includes a learn cache configured to store key entries for storage in the flow key database.

Systems for and methods of flow table management

A highly parallel programmable packet editing engine with a scalable control infrastructure includes receiving an ingress packet having one or more headers; assigning, by one or more processors, the one or more headers of the ingress packet to a number of zones, wherein each zone is a grouping of adjacent headers that are closely related to one another by information content or processing type; performing, by the one or more processors, offset computations for the one or more headers in a zone concurrently with offset computations of headers assigned to other zones; performing, by the one or more processors, different header operations on the one or more headers concurrently with respective ones of a plurality of editing engines; combining, by the one or more processors, the edited one or more headers at the computed offsets to generate a modified egress packet; and providing, for transmission, the modified egress packet.

Highly parallel programmable packet editing engine with a scalable control infrastructure

A system includes a forwarding instance that is configured to receive a packet from a source on a port that is a member port of an etherchannel bundle. The forwarding instance is configured to update a table with information that correlates the source with the port. The forwarding instance is also configured to send a synchronization packet to other forwarding instances having ports that are member ports of the etherchannel bundle. Upon receipt of the synchronization packet, the other forwarding instances are configured to update tables with the information that correlates the source with the port.

Distributed switch with conversational learning

In one implementation, a cluster of network devices forwards packets within the cluster according to a node vector and a cluster database. The cluster database defines a path from each network device in the cluster to every other network device in the cluster. When a packet is received, the receiving network device accesses a forwarding database for egress ports according to a destination address of the packet and accesses the cluster database to identify a first cluster link in the path from the receiving network device to the egress network device. The receiving network device adds a node vector to the packet. The node vector communicates to subsequent network devices how the packet is to be forwarded through the cluster on the path from the receiving network device to the egress network device. The node vector is specific to the network device cluster and operates independent from packet forwarding protocols.

Packet transport for network device clusters

A cache controller is disclosed. The cache controller includes potential replacement list, a plurality of valid bits and a number of counters. The potential replacement list includes a number of entries. Each of the valid bits corresponds to one of the entries. Each of the counters also corresponds to the one of the entries.

Method and apparatus for randomized cache entry replacement

A method and apparatus for processing incomplete SSL/TLS records is disclosed. Typical processing of encrypted and authenticated SSL/TLS records involves reconstructing the entire record after if has been segmented by a transport layer in order to be sent over a networked connection. This creates a significant performance bottleneck. The disclosed invention takes the truncated records as they arrive and creates block-aligned segments (truncated records), coupled with residue left to transfer between an arriving segment and the previously block-aligned segment, which allows continuous processing of the encrypted partial records.

Growing community of inventors

Santa Clara, CA, United States of America

Rajan Sharma