Palo Alto Networks, Inc.

Cisco Technology, Inc.

Subramani Ganesh

Sidong Li

Lei Chang

William Alan Roberson

Savitha Raghunath

Gyanesh Saharia

De Bao Vu

Matthew Robert Rohm

Luan Bui

Murali Chundi

Techniques for reduction and acceleration of a deterministic finite automaton (DFA) are disclosed. In some embodiments, a system, process, and/or computer program product for reduction and acceleration of a DFA includes receiving an input value; performing a reduced deterministic finite automaton lookup using a lookup key, wherein the lookup key comprises a current state and the input value; and determining a next state based on the lookup key.

Reduction and acceleration of a deterministic finite automaton

To use larger capacity TCAMs while avoiding various packaging and power management issues of TCAMs, pre-processing can be performed on TCAM lookup requests to intelligently pipeline lookup requests according to a defined power budget that is based on TCAM and power supply specifications. Dividing lookup requests based on a power budget smooths the instantaneous current demand and dynamic power demand. This intelligent pre-processing of lookup requests allows lookup requests that satisfy a power budget based threshold to still complete within a single clock cycle while nominally reducing performance for those lookup requests that would not satisfy the power budget based threshold. When a lookup request will not satisfy the power budget based threshold, the lookup request is split into searches targeting different memory blocks of the TCAM.

Amortizing dissipated power and current demand in a ternary content addressable memory

A network security device includes a network flow statistics processing engine to process network flow information related to network flows. The network flow statistics processing engine includes a first processing stage performing per-flow information aggregation and a second processing stage performing per-destination system component information aggregation, with each processing stage implementing a threshold-based data export scheme and a timer-based data export scheme. In this manner, up-to-date flow information is available to peer system components regardless of the varying flow rates of the network flow.

Network device implementing two-stage flow information aggregation

First, a packet may be received and a timestamp value may be placed on the packet. The timestamp value may comprise a place time value comprising a time when the timestamp was placed on the packet plus a delay time value comprising an estimated time delay between when the timestamp was placed on the packet and when the packet leaves a port exit. Next, the packet may be sent to a first in first out (FIFO) memory. The packet may then be sent from the FIFO memory out the port exit.

Timestamp estimation and jitter correction using downstream FIFO occupancy

Growing community of inventors

Sunnyvale, CA, United States of America

Subramani Ganesh