Juniper Networks, Inc.

Ramesh Panwar

Deepak Goel

Nazar A Zaidi

Srinivasan Jagannadhan

Frederick R Gruner

David T Hass

Elango Ganesan

Robert G Hathaway

Mark Vilas

Michael Freed

Ricardo Ramirez

Yen C Lee

Mark Bryers

Sankar Ramanoorthi

John Phillips

Yuhong Zhou

Gregory G Spurrier

Philip A Thomas

Abbas Rashid

Chau Anh Ngoc Nguyen

Jean-Marc Frailong

Jianhui Huang

David Weinberg

Fred Gruner

Gary S Goldman

Chau Ahn Ngoc Nguyen

In general, techniques are disclosed to facilitate communicating within computer networks. For example, a layer three (L3) router including a service card and an interface card may be configured to perform the techniques. The interface card receives a query from a network that sources communications in accordance with a plurality of models. The query may specify a customer device and one of the sourced communications, and request that the service card select one of the models for the specified sourced communication and the specified customer device. The service card further stores data defining a profile for the one of the customer devices. The service card may also, in response to the query, analyze the profile data for the specified customer device to determine the selected one of the models for the specified sourced communication with respect to the specified customer device.

Network router having service card

In one embodiment, a method includes receiving a value associated with a data packet and identifying a data set based on the value. The data set is associated with a range of values and represents routing actions. The data set is a first data set from a plurality of data sets if the value is included in the range of values associated with the first data set. The data set is a default data set if the value is not included in a range of values associated with a data set from the plurality of data sets. The method includes combining the first data set with the default data set if the first data set is identified. The method includes combining the default data set with an except data set if the default data set is identified.

Methods and apparatus to implement except condition during data packet classification

A network content service apparatus includes a set of compute elements adapted to perform a set of network services; and a switching fabric coupling compute elements in said set of compute elements. The set of network services includes firewall protection, Network Address Translation, Internet Protocol forwarding, bandwidth management, Secure Sockets Layer operations, Web caching, Web switching, and virtual private networking. Code operable on the compute elements enables the network services, and the compute elements are provided on blades which further include at least one input/output port.

Content service aggregation system

This disclosure describes techniques of determining whether a symbol stream includes a pattern defined by a regular expression. As described herein, the regular expression may be represented using a non-deterministic finite automaton (NFA). A plurality of states in the NFA may be evaluated in parallel. These states may be associated with a plurality of symbol positions in a symbol stream. Evaluating a plurality of states and symbols in parallel may allow for faster determinations of whether the symbol stream includes the pattern defined by the regular expression.

Parallelized pattern matching using non-deterministic finite automata

In one embodiment, a method includes receiving a bit value from a key vector. The bit value has a position within the key vector correlating to a counter value. The method includes receiving a sequence of bit values from a plurality of predefined bit values based on the counter value and in response to a condition associated with the bit value from the key vector being satisfied.

Methods and apparatus for producing a hash value based on a hash function

In one embodiment, a method includes receiving a policy vectors associated with a switch fabric, determining a compression scheme, and producing a compressed vector based on the policy vector and the compression scheme. The policy vector is represented by a bit sequence and has a plurality of policy bit values. A policy bit value from the plurality of policy bit vales is configured to trigger an action associated with a data packet in the switch fabric. The compression scheme is determined based on a portion of the policy vector.

Methods and apparatus for compression in packet classification

In one embodiment, an apparatus comprises a range selection module, a first stage of bloom filters, a second stage of bloom filters and a hashing module. The range selection module is configured to define a set of hash key vectors based on a set of range values associated with at least a portion of an address value from a data packet received at a multi-stage switch. The first stage of bloom filters and the second stage of bloom filters are collectively configured to determine that at least a portion of a hash key vector from the set of hash key vectors has a probability of being included in a hash table. The hashing module is configured to produce a hash value based on the hash key vector such that a first policy vector is selected based on the hash value and the first policy vector is decompressed to produce a second policy vector associated with the data packet.

Methods and Apparatus Related to Packet Classification Based on Range Values

In one embodiment, an apparatus can include a policy vector module configured to retrieve a compressed policy vector based on a portion of a data packet received at a multi-stage switch. The apparatus can also include a decompression module configured to receive the compressed policy vector and configured to define a decompressed policy vector based on the compressed policy vector. The decompressed policy vector can define a combination of bit values associated with a policy.

Methods and apparatus related to packet classification associated with a multi-stage switch

In one embodiment, an apparatus includes a loopback module configured to receive a first copy of a target vector during a clock cycle. The target vector can include a quantity of set bit values and can be defined based on a portion of data. The loopback module can be configured to define a loopback vector that has a quantity of set bit values that is less than a quantity of set bit values included in the first copy of the target vector. The apparatus also can include an index module configured to receive a second copy of the target vector during the clock cycle. The index module can be configured to define, during the clock cycle, an index vector based on the second copy of the target vector. The index vector can be configured to trigger an element associated with a switch fabric to process the data.

Methods and apparatus for indexing set bit values in a long vector associated with a switch fabric

In general, techniques are described for utilizing anonymous cookies within computer networks to protect customer identities. In particular, a network device is configured to communicate with an edge router of a service provider network that provides access to a public network having network destinations. The network device includes a control unit and an interface. The control unit executes a content delivery layer and a privacy services layer. The content delivery layer receives a network communication sent from one of the customer devices to the public network. The privacy services layer replaces a destination-specified cookie within the network communication with an anonymous cookie, each of which conform to an application layer protocol. The anonymous cookie also specifies a pseudonym for the one of the customer devices that originated the network communication. The at least one interface then forwards the network communication including the anonymous cookie to the network destination.

Providing privacy within computer networks using anonymous cookies

In one embodiment, a method includes receiving a key associated with a portion of a data packet, comparing the key to a first range extreme, selecting a second range extreme, and comparing the key with the second range. The first range extreme is associated with a first range and the second range is associated with a second range. The second range is selected based on the comparing the key to the first range extreme. The method includes producing a policy vector associated with the first or second range.

Methods and apparatus for range matching during packet classification based on a linked-node structure

In one embodiment, a method includes classifying a data packet received at a switch fabric, selecting an action descriptor in response to the classifying, and processing an action defined in the action descriptor. The classifying is based on a primary classification condition and first portion of the data packet. The action descriptor is associated with the primary classification condition. The processing includes determining whether a secondary classification condition is satisfied by a second portion of the data packet.

Growing community of inventors

Pleasanton, CA, United States of America

Ramesh Panwar