Fortinet, Inc.

Cisco Technology, Inc.

Ericsson Ab

Google Inc.

Sachin Desai

Chandramouli Sargor

Rajesh I Balay

Zahid S Hussain

Tim Millet

Amit K Khetawat

Francois Lemarchand

Paul Kim

Louise Y Yeung

Ken Yeung

Naveed Alam

Joseph Cheng

Thalanayar Muthukumar

Abraham Rabindranath Matthews

Sajit Bhaskaran

Lianghwa Jou

Methods and systems for bridging network packets transmitted over heterogeneous media channels are provided. According to one embodiment, a network device maintains translation data structures defining translations among multiple framing media formats used for transmitting or receiving network packets via multiple supported media transmission channels, including (i) between a first framing media format and an intermediate format and (ii) between the intermediate format and a second framing media format. A virtual bridging application representing a single bridging domain for bridging all network traffic traversing the network device translates ingress network packets from the first framing media format to egress network packets of the second framing media format based the translation data structures.

Heterogeneous media packet bridging

Methods and systems for bridging network packets transmitted over heterogeneous media channels are provided. According to one embodiment, a network switching/routing blade server comprises network modules, including a first and second set operable to receive packets having a first and second framing media format, respectively. A single bridging domain is provided by a shared bridging application. A memory stores data structures for translating between the first and second framing media formats via an intermediate format. The netmods pass a received packet, through a switching fabric, to the bridging application, which determines a relay location for the packet and whether the relay location is among the other set of netmods. Responsive to an affirmative determination, the bridging application uses the translation data structures to translate the packet before relaying the packet to the relay location.

Methods and systems for bridging network packets transmitted over heterogeneous media channels are provided. According to one embodiment, a network switching/routing blade server comprises network interfaces, including a first and second set operable to receive packets encapsulated within a first and second set of media transmissions, respectively, and each having a first and second framing media format, respectively. A single bridging domain is provided by a shared bridging application. A memory stores data structures for translating between the first and second framing media formats via an intermediate format. The netmods pass a received packet, through a switching fabric, to the bridging application, which determines a relay location for the packet and whether the relay location is among the other set of netmods. Responsive to an affirmative determination, the bridging application uses the translation data structures to translate the packet before relaying the packet to the relay location.

Methods and systems are provided for steering network packets. According to one embodiment, a dynamically configurable steering table is stored within a memory of each network interface of a networking routing/switching device. The steering table represents a mapping that logically assigns each of the network interfaces to one of multiple packet processing resources of the network routing/switching device. The steering table has contained therein information indicative of a unique identifier/address of the assigned packet processing resource. Responsive to receiving a packet on a network interface, the network interface performs Layer 1 or Layer 2 steering of the received packet to the assigned packet processing resource by retrieving the information indicative of the unique identifier/address of the assigned packet processing resource from the steering table based on a channel identifier associated with the received packet and the received packet is processed by the assigned packet processing resource.

Network packet steering via configurable association of packet processing resources and network interfaces

Methods and systems for bridging network packets transmitted over heterogeneous media channels are provided. According to one embodiment, a network device comprises network interfaces (netmods), including a first and second set operable to receive packets encapsulated within a first and second set of media transmissions, respectively, and each having a first and second framing media format, respectively. A single bridging domain is provided by a shared bridging application. A memory stores data structures for translating between the first and second framing media formats via an intermediate format. The netmods pass a received packet, through a switching fabric, to the bridging application, which determines a relay location for the packet and whether the relay location is among the other set of netmods. Responsive to an affirmative determination, the bridging application uses the translation data structures to translate the packet before relaying the packet to the relay location.

Methods and systems are provided for applying metering and rate-limiting in a virtual router environment and supporting a hierarchy of metering/rate-limiting contexts per packet flow. According to one embodiment, multiple first level metering options and multiple second level metering options associated with a hierarchy of metering levels are provided. A virtual routing engine receives packets associated with a first packet flow and packets associated with a second packet flow. The virtual routing engine performs a first type of metering of the first level metering options on the packets associated with the first packet flow using a first metering control block (MCB) and performs a second type of metering of the second level metering options on the packets associated with the first packet flow and the packets associated with the second packet flow using a second MCB.

Hierarchical metering in a virtual router-based network switch

A method and apparatus for detecting peer traffic based on a heuristic model and deep packet inspection is described. A suspect set of peer packets is detected using a heuristic model. From the suspect set of peer packet, a set of verified peer packets is detected using deep packet inspection. The set of verified peer packets is processed according to the peer processing policy, while the non-verified peer packets is processed according a non-peer policy. Furthermore, the statistics are generated from the set of suspect peer packet. These statistics are used to update the heuristic model.

Flexible, cost-effective solution for peer-to-peer, gaming, and application traffic detection and treatment

Methods and systems for bridging network packets transmitted over heterogeneous media channels are provided. According to one embodiment, a network-computing device comprises multiple network interfaces (netmods) and a shared processing resource. The shared processing resource executes a virtual bridging application representing a single bridging domain for all network packets received by the network-computing device. A translation data structure defines translations between a first framing media format and an intermediate format and between the intermediate format and a second framing media format. If the virtual bridging application determines a network packet is to be relayed between a netmod operable to receive network packets encapsulated within the first framing media format and a netmod operable to transmit network packets encapsulated within the second framing media format, then it uses the translation data structures to translate the network packet before relaying the network packet.

Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a connection for a subscriber is created based on a service context of the subscriber. A connection request is received from a subscriber of a network service delivery environment. The subscriber is associated with a first-level profile identifier indicative of a service context for the subscriber. One or more other subscribers can be associated with the first-level profile identifier. Lower-level profile identifiers are determined using the first-level profile identifier. The lower-level profile identifiers indicate a set of services that is available to the subscriber during the connection. Creating a connection for the subscriber that enables forwarding of packets based on the lower-level profile identifiers.

Managing hierarchically organized subscriber profiles

Methods and systems are provided for steering network packets. According to one embodiment a method is provided for steering incoming network packets. Each network packet processing resource of a network routing/switching device is dynamically assigned to one or more network interfaces of the network routing/switching device. Each of the network packet processing resources includes one or more processing elements and a memory. Incoming network packets received by the network interfaces are steered to an appropriate network packet processing resource based on the dynamic assignment.

Network packet steering via configurable association of processing resources and network interfaces

Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment, a policy engine of a VR defines services available to subscribers in terms of profile identifiers. A scalable subscriber profile database is established having a memory requirement dependent upon the number of available service contexts by hierarchically organizing profile identifiers as leaf profile identifiers, which explicitly define services, and intermediate profile identifiers, which indirectly represent services. The policy engine receives a first-level profile identifier and determines whether it is among those stored in the database. If not, then it obtains service profile information associated with the first-level profile identifier. If the first-level profile identifier is an intermediate profile identifier having leaf profile identifiers, then it further obtains them and associated profile information and stores this information in the database. The first-level profile identifier and the associated service profile information are also stored in the database.

Methods and systems are provided for steering network packets. According to one embodiment, a mapping associates a processing resource with a network interface module (netmod) and/or a number of line interface ports included within the netmod. In one embodiment, the mapping is configurable within the processing resource and pushed to the netmod. The netmod uses the mapping to steer network packets to the processing resource when the packets conform to the mapping. The mapping may be additionally used to identify a specific process that is to be performed against the packets once the processing resource receives the steered packets from the netmod.

Network packet steering via configurable association of processing resources and netmods or line interface ports

Methods are provided for managing hierarchically organized subscriber profiles. According to one embodiment of the present invention, a subscriber connection is created with a virtual router operable within a telecommunications system of a service provider. A connection request is received from a subscriber of multiple subscribers of the service provider at a subscriber manager of the virtual router. The virtual router maintains a database of hierarchically organized profile identifiers, including multiple lower-level profile identifiers, which explicitly define subscriber services, and multiple first-level profile identifiers, which define service contexts representing combinations of services available to subscribers when connected by (i) explicitly defining the subscriber services or (ii) referring to one or more of the multiple lower-level profile identifiers. If the subscriber is successfully authenticated, a connection is created by creating and configuring a virtual interface within the virtual router for the subscriber connection based on the subscriber's first-level profile identifier.

Growing community of inventors

Santa Clara, CA, United States of America

Sachin Desai