Applied Micro Circuits Corporation

Nicira, Inc.

Cisco Technology, Inc.

Plumgrid, Inc.

Vmware, Inc.

University of Southern California

Sushil Kumar Singh

Pere Monclus

Kenneth Yun

Kirk Alvin Miller

George Bendak

John David Huber

Awais Bin Nemat

Prayag Bhanubhai Patel

Alexei Starovoitov

Michael Hellmer

Brenden Blanco

Jianfeng Shi

Viet Linh Do

Kevin Warren James

Eli James Aubrey Fernald

Ayoob Eusoof Dooply

Gaetano Borgione

Jayant Jain

Anirban Sengupta

Sumeet Singh

Ying Liu

Subrahmanyam Manuguri

Keith Michael Chugg

Alok S Tiagi

Philip Michael Clovis

Peter A Beerel

George Varghese

Guglielmo Marco Morandin

Sushruth Gopal

Jonathan Chang

Valentina Alaria

David Thomas Dougherty

Phunsak Thiennviboon

John Calvin Leung

Syed Khayam

Deepa Kalani

Recep O Ozdag

Sunan Tugsinavisut

Jorge Jaramillo

Alexei Starovaitov

Max Bielenberg

Carolina Pena

Marco Leogrande

Arslan Waqar

Dragos Rusu

Duyen Riggs

The method for implementing mechanisms for Layer 7 context accumulation for enforcing Layers 4, 7, and verb-based rules is presented. The method comprises: receiving stream data, and identifying a packet in the stream. If the packet includes Layer 7 headers: for each Layer 7 header: determining content of the packet identified by a Layer 7 header's identifier; and parsing the content to extract firewall input data. If one or more rules at least partially match the firewall input data, determining that a particular rule also includes additional information that cannot be found in the firewall input data; performing a DPI on the content to determine whether at least a portion of the additional information is found in the content; extracting additional input data from the content and adding it to the firewall input data; and applying the rules to the firewall input data to process the packet.

Mechanisms for layer 7 context accumulation for enforcing layer 4, layer 7 and verb-based rules

A network management system manages a virtual network includes an interface system communicatively coupled to one or more servers, a director engine, and a configuration engine. The one or more servers implement a virtual network including one or more virtual machines and one or more containers organized into one or more virtual domains. The interface system generates a graphical user interface displaying graphical representations of the one or more virtual machines and the one or more containers and of the one or more servers; and information associated with the virtual network. The director engine receives a user selection of at least one server, virtual machine, container, or virtual domain, accesses information associated with the user selection, and identifies one or more of servers, virtual machines, containers, and virtual domains associated with the user selection.

Virtual network management

Example methods and systems for managing interconnection of virtual network functions are disclosed. Example methods disclosed herein include, in response to a trigger event indicating detection of an interface, obtaining a virtual network domain template corresponding to a virtual network domain to be configured, the virtual network domain template identifying one or more virtual network functions and one or more interfaces, at least some of the virtual network functions being connected together through one or more links. Disclosed example methods further include configuring and provisioning the virtual network domain to contain the interface using the virtual network domain template and properties of the interface to enable the interface to send information in the virtual network domain.

Methods and systems for managing interconnection of virtual network functions

A method and apparatus is disclosed herein for use of a connectivity manager and a network infrastructure including the same. In one embodiment, the network infrastructure comprises one or more physical devices communicably coupled into a physical network infrastructure or via the overlay provided by the physical servers; and a virtual network domain containing a virtual network infrastructure executing on the physical network infrastructure. In one embodiment, the virtual network domain comprises one or more virtual network functions connected together through one or more links and executing on the one or more physical devices, and one or more interfaces coupled to one or more network functions via one or more links to communicate data between the virtual network domain and at least one of the one or more physical devices of the physical network infrastructure while the virtual network domain is isolated from other virtual infrastructures executing on the physical network infrastructure.

Method and system for managing interconnection of virtual network functions

A method for monitoring network conditions by receiving a first condition definition describing a first network condition to be monitored in a network and an activation definition, determining a network topology of the network, and compiling the first condition definition to generate a first data plane component, a first control plane component, and an activation component. The method also includes deploying the first data plane component into a data plane of the network, where the data plane component captures and synthesizes a first stream of network events to generate a first modified stream of network events. The method also includes deploying the control plane component into a network operating system for the network. The control plane component receives and correlates the first modified stream of network events. The method also includes deploying an activation component that, upon receiving the correlated stream of events, initiates the activation definition.

Method and system for monitoring conditions in a dynamic network environment

In one implementation, a network device is configured to implement an intra switch transport protocol. The intra switch transport protocol is configured to determine a window size according to a predetermined bandwidth and a round trip time between a plurality of ingress ports and an egress port. The network device is configured to sending at least one data packet from an ingress port to an egress port without first receiving any acknowledgement from the egress port. The network device continues to send packets and increment a counter accordingly until the counter reaches the window size. The network device ceases transmission of subsequent data packets and/or queues subsequent data packets based on the counter exceeding the window size.

Intra switch transport protocol

A method for network storage by receiving, by a storage compiler, a first storage definition from a storage application developer, where the first storage definition describes a customized storage implementation for storing data in an abstraction of at least one physical storage device, compiling the first storage definition to generate a first customized storage implementation module, and loading the first customized storage implementation module into an IO engine. The first customized storage implementation module causes data to be stored in the at least one physical storage device differently than prior to loading the first customized storage implementation module in the IO engine.

Method and system for data plane abstraction to enable a network storage platform ecosystem

The method includes receiving, by a data plane definition language compiler, a first data plane definition describing customized functionality of a data plane of a first network application, and compiling the data plane definition to generate a first set of customized data processing modules and a program interface that allows a control plane of the network application to access the first set of customized data processing modules. The method also includes loading the first set of customized data processing modules into a data plane container, wherein the network application is executed via a network operating system, and wherein, upon execution of the network application the customized data processing module causes the data plane container of the network application to process packets differently than prior to loading the customized data processing module in the data plane container.

Method and system for data plane abstraction to enable a dynamic creation of network applications

A method and a computer-readable storage medium are disclosed for flexible network measurement. Embodiments disclose receiving a network measurement request, transmitting portions of the request to network devices, configuring the network devices to collect metrics from packet data based on the portions of the request, and performing operations to generate metrics as a response to the network measurement request. Embodiments also disclose a flexible, dynamically configurable packet parser. Other embodiments are also disclosed.

Flexible network measurement

A method and apparatus is described for identifying content in a packet. The method may obtain data sample from the packet where the data sample is in a predetermined window at an initial offset point in the packet. For each offset point, a first stage of processing on the data sample may be performed to identify if the data sample corresponds to potentially relevant reference string. A more focused second stage of processing may then be carried out on the data sample to identify if the data sample corresponds to potentially relevant reference string. Thereafter, an even more focused third stage of processing may be carried out on the data sample to obtain a third stage result. If the data sample passes all three stages of processing, a predefined action is identified which is associated with a reference string corresponding to the data sample.

Scalably detecting and blocking signatures at high speeds

A system and method are provided for tolerating data line faults in a packet communications switch fabric. The method comprises: accepting information packets including a plurality of cells, at a plurality of ingress port card ports, the plurality of information packets addressing a plurality of egress port card ports; selectively connecting port card ports to port card backplane data links; selectively connecting port card backplane data links and crossbars; sensing a connection fault in a backplane data link; in response to sensing the fault, reselecting connections between the port card ports and the port card backplane data links; in response to reselecting connections between the port card ports and the port card backplane data links, serially transferring packets through the port cards; serially transferring packets through the crossbars to the egress port cards; and, suspending use of the faulty connection.

System and method for tolerating data link faults in a packet communications switch fabric

A system and method are provided for resynchronizing backplane link management credit counters in a packet communications switch fabric. The method comprises: at an input port card ingress port, accepting information packets including cells and cell headers with destination information; modifying the destination information in the received cell headers; routing information packets between the input port card and output port cards on backplane data links through an intervening crossbar; at the input port card, maintaining a credit counter for each output port card channel; decrementing the counter in response to transmitting cells from the input port card; generating credits in response to transmitting cells from an output port card channel; sending the generated credits to increment the counter, using the modified destination information; and, using the generated credit flow to resynchronize the credit counter.

System and method for synchronizing switch fabric backplane link management credit counters

A system and method are provided for configuring interface bandwidths in a packet communications switch fabric. The method comprises: interfacing data links with a first plurality of traffic managers (TMs); differentiating port card interface ports into a first plurality of subchannels associated with the first plurality of TMs; and, communicating packets information with the TMs at a first plurality of data rates corresponding to the first plurality of subchannels. More specifically, differentiating port card interface ports into a first plurality of subchannels associated with the first plurality of TMs includes: differentiating a second plurality of ingress data links into a third plurality of ingress subchannels associated with a third plurality of ingress traffic managers (iTMs); and, differentiating a fourth plurality of egress data links into a fifth plurality of egress subchannels associated with a fifth plurality of egress TMs (eTMs).

Configurable switch fabric interface bandwidth system and method

A credit-based system and method are provided for managing backplane traffic flow in a packet communications switch fabric. The method comprises: accepting information packets including cells and cell headers with destination information; modifying the destination information in the received cell headers; routing information packets between an input port card and output port cards on backplane data links through an intervening crossbar; at the input port card, maintaining a credit counter for each output port card channel; decrementing the counter in response to transmitting cells from the input port card; generating credits in response to transmitting cells from an output port card channel; and, using modified destination information, sending the generated credits to increment the counter. In some aspects, modifying the destination information in the received packet headers includes: extracting the output port card termination from the card field; and, inserting the input port card source in the card field.

Switch fabric backplane flow management using credit-based flow control

A system and method are provided for tolerating data line faults in a packet communications network. The method comprises: serially transmitting information packets from at least one traffic manager (TM); at a switch fabric, accepting information packets at a plurality of ingress ports, the information packets addressing destination port card egress ports; selectively connecting port card ingress ports to port card egress ports; serially supplying information packets from a plurality of port card egress ports; sensing a connection fault between the switch fabric and the TM; and, in response to sensing the fault, reselecting connections between the switch fabric port card ports and the TM. Some aspects comprise: an ingress memory subsystem (iMS) receiving cells on an ingress port exceeding an error threshold. Then, reselecting connections between the port card ports and the TM includes the iMS sending a message to the iTM identifying the faulty ingress connection.

System and method for tolerating data link faults in communications with a switch fabric

Growing community of inventors

San Diego, CA, United States of America

Sushil Kumar Singh