Fortinet, Inc.

Apple Inc.

Google Inc.

Cisco Technology, Inc.

Silicon Graphics, Incorporated

Tim Millet

Zahid S Hussain

Joseph Cheng

Sachin Desai

Naveed Alam

Paul Kim

Louise Y Yeung

Ken Yeung

Samir Jain

Michael F Culbert

Ian C Hendry

Kenneth Christian Dyke

David J Redman

Thomas W Costa

Adrian T Sheppard

Greg Lockwood

Eve Brasfield

Amanda R Rainer

Mike Nugent

Ingrid Aligaen

Chris Niederauer

Geoffrey Grant Stahl

Geoff Stahl

Gregory Lockwood

Methods and systems for hardware-accelerated packet multicasting are provided. According to one embodiment, a first multicast packet to be multicast to a first multicast destination is received by a virtual routing system. The multicast packet is caused to be transmitted to the multicast destination by: (i) directing the multicast packet to a first VR of multiple VRs instantiated within the virtual routing system by selecting the first VR from among the multiple VRs to multicast the multicast packet; (ii) configuring the virtual routing system to use a routing context associated with the selected VR in connection with processing of the multicast packet; (iii) reading at least a portion of the multicast packet from one of multiple multicast address spaces associated with the selected VR; and (iv) forwarding the multicast packet to the first multicast destination. Similar steps are then performed for a second multicast packet.

Hardware-accelerated packet multicasting

Methods and systems for determining a token master on a ring network are provided. According to one embodiment, a ring controller of a first blade participating in the ring network receives an indication that an arbitration token originated by an originating blade has been received. The ring controller compares the priorities of the originating blade and the first blade. When the priority of the originating blade is higher, the ring controller transmits the arbitration token to the next blade. When the priority of the originating blade is lower, the ring controller sets the first blade as the originating blade and transmits the arbitration token to the next blade. When the priorities are equal, the ring controller assumes the role of the token master, which is responsible for periodically transmitting a discovery marker onto the ring network to facilitate topology discovery.

Identifying nodes in a ring network

Methods and systems for providing IP services in an integrated fashion are provided. According to one embodiment, a flow cache is established having multiple entries each identifying one of multiple VR flows through a VR-based network device and corresponding forwarding state information. A packet is received at an input port of a line interface module of the network device and forwarded to a VRE. Flow-based packet classification is performed by the VRE. An attempt is made to retrieve an entry of the flow cache based on a result of the flow-based packet classification. On a flow cache hit, one or more appropriate packet transformations are identified for application to the packet and it is determined whether to process the packet with a VSE based on the corresponding forwarding state information. On a flow cache miss, the new VR flow is added to the flow cache by performing flow learning.

Service processing switch

Methods and systems for determining a token master on a ring network are provided in which possession of an arbitration token permits a blade participating in the ring network to transmit a packet. According to one embodiment, when an event at a blade represents expiration of a timeout period for receipt of the token, a new token is transmitted onto the ring network. When the event represents receipt of the token, then the priority of the originating blade is compared that of the first blade. When the originating blade is higher priority, the token is transmitted to the next blade. When the originating blade is lower priority, the first blade is set as the originating blade and the token is transmitted to the next blade. When the priorities are equal, the blade becomes responsible for periodically transmitting a discovery marker onto the ring network to facilitate topology discovery.

Methods and systems for hardware-accelerated packet multicasting are provided. According to one embodiment, a first packet to be multicast to a first destination and a second packet to be multicast to a second destination are received. The first and second packets are classified in accordance with different virtual routers (VRs) of multiple VRs instantiated by a virtual routing engine (VRE) of a virtual routing system by determining a first selected VR to multicast the first packet and a second selected VR to multicast the second packet. For each of the first and second packets: a routing context of the VRE is switched to a routing context associated with the selected VR; at least a portion of the packet is read from one of multiple multicast address spaces associated with the selected VR; and the packet is forwarded to the destination.

Methods and systems are provided for steering network packets. According to one embodiment, a dynamically configurable steering table is stored within a memory of each network interface of a networking routing/switching device. The steering table represents a mapping that logically assigns each of the network interfaces to one of multiple packet processing resources of the network routing/switching device. The steering table has contained therein information indicative of a unique identifier/address of the assigned packet processing resource. Responsive to receiving a packet on a network interface, the network interface performs Layer 1 or Layer 2 steering of the received packet to the assigned packet processing resource by retrieving the information indicative of the unique identifier/address of the assigned packet processing resource from the steering table based on a channel identifier associated with the received packet and the received packet is processed by the assigned packet processing resource.

Network packet steering via configurable association of packet processing resources and network interfaces

Methods, systems and data structures for determining a token master on a ring network are provided. According to one embodiment, determining a token master on a ring network includes receiving a packet containing a network token at a first node on the network. If the network token does not arrive within a preselected timeout period, generating an arbitration token. If the packet contains an arbitration token, determining if the arbitration token was modified by a higher priority node of the network and if not, setting the first node as a token master and converting the arbitration token to a packet transmission token. Arbitration tokens are used to identify a token master that is responsible for generating a packet transmission token onto the network, whereas the packet transmission token authorizes a transmitting node that has most recently received the packet transmission token to transmit locally generated packets onto the network.

Methods and systems for providing IP services in an integrated fashion are provided. According to one embodiment, packets are load balanced among virtual routing processing resources of an IP service generator of a virtual router (VR) based switch. A packet flow cache is maintained with packet flow entries containing information indicative of packet processing actions for established packet flows. Deep packet classification is performed to determine whether a packet is associated with an established packet flow. If so, the packet is directed to one of multiple virtual services processing resources representing application-tailored engines configured to provide managed firewall services. If the packet is allowed, it is returned to the source virtual routing processing resource for forwarding.

Methods and systems for hardware-accelerated packet multicasting are provided. According to one embodiment, a multicast packet is received at an ingress system of a packet-forwarding engine (PFE). Multiple flow classification indices are identified for the multicast packet by the ingress system. The multiple flow classification indices are sent to an egress system of the PFE by the ingress system. A single copy of the multicast packet is buffered in a memory accessible by the egress system. Corresponding transform control instructions are identified by the egress system based on each flow classification index. The single copy of the multicast packet is read from the memory. The multicast packet is transformed to an outgoing packet for each instance of the multicast packet based on the corresponding transform control instructions. The outgoing packet is transmitted for routing to a network.

Methods and systems are provided for applying metering and rate-limiting in a virtual router environment and supporting a hierarchy of metering/rate-limiting contexts per packet flow. According to one embodiment, multiple first level metering options and multiple second level metering options associated with a hierarchy of metering levels are provided. A virtual routing engine receives packets associated with a first packet flow and packets associated with a second packet flow. The virtual routing engine performs a first type of metering of the first level metering options on the packets associated with the first packet flow using a first metering control block (MCB) and performs a second type of metering of the second level metering options on the packets associated with the first packet flow and the packets associated with the second packet flow using a second MCB.

Hierarchical metering in a virtual router-based network switch

Exemplary embodiments of methods, apparatuses, and systems for seamlessly migrating a user visible display stream sent to a display device from one rendered display stream to another rendered display stream are described. For one embodiment, mirror video display streams are received from both a first graphics processing unit (GPU) and a second GPU, and the video display stream sent to a display device is switched from the video display stream from the first GPU to the video display stream from the second GPU, wherein the switching occurs during a blanking interval for the first GPU that overlaps with a blanking interval for the second GPU.

Seamless display migration

Methods and systems are provided for hardware-accelerated packet multicasting in a virtual routing system. According to one embodiment, a virtual routing engine (VRE) including virtual routing processors and corresponding memory systems are provided. The VRE implements virtual routers (VRs) operable on the virtual routing processors and associated routing contexts utilizing potentially overlapping multicast address spaces resident in the memory systems. Multicasting of multicast flows originated by subscribers of a service provider is simultaneously performed on behalf of the subscribers. A VR is selected to handle multicast packets associated with a multicast flow. A routing context of the VRE is switched to one associated with the VR. A packet of the multicast flow is forwarded to multiple destinations by reading a portion of the packet from a common buffer for each instance of multicasting and applying transform control instructions to the packet for each instance of multicasting.

Hardware-accelerated packet multicasting in a virtual routing system

Methods and systems for providing IP services in an integrated fashion are provided. According to one embodiment, a load associated with multiple virtual routing processing resources of an IP service generator of a virtual router (VR) based switch is monitored. Packets are load balanced among the virtual routing processing resources. A packet flow cache is maintained with packet flow entries containing information indicative of packet processing actions for established packet flows. Deep packet classification is performed to determine whether a packet is associated with an established packet flow. If so, the packet is directed to one of multiple virtual services processing resources representing application-tailored engines configured to provide network-based IP services including one or more of virtual private network (VPN) processing, firewall processing, Uniform Resource Locator (URL) filtering and anti-virus processing. If the packet is allowed, it is returned to the source virtual routing processing resource for forwarding.

Methods and systems are provided for steering network packets. According to one embodiment a method is provided for steering incoming network packets. Each network packet processing resource of a network routing/switching device is dynamically assigned to one or more network interfaces of the network routing/switching device. Each of the network packet processing resources includes one or more processing elements and a memory. Incoming network packets received by the network interfaces are steered to an appropriate network packet processing resource based on the dynamic assignment.

Growing community of inventors

Mountain View, CA, United States of America

Tim Millet