F5 Networks, Inc.

Alcatel Internetworking, (pe), Inc.

F5, Inc.

Alcatel Lucent

Packet Engines Incorporated

Other

Alcatel

Alcatel-lucent USA Inc.

Fs, Inc.

Timothy Scott Michels

Paul Imre Szabo

William Ross Baumann

Hao Cai

James E Cathey

Greg W Davis

Peter Michael Thornewell

Bernard N Daines

Jim Cathey

Joel Benjamin Moses

Jayasenan Sundara Ganesh

C Stuart Johnson

Lars Pierson Friend

Jayansenan Sundara Ganesh

Parmajeet Singh

Timothy Worsley

Michael Thomas Barthelow

Jonathan Mini Hawthorne

Alan B Mimms

Adam Huson

Steven D Dabell

Michael Dale Helbling

Jagir Maya Rai

Steven Dabell

Steve Dabell

Clay Jones

David Ryan

Thomas Troksa

Daniel J McDermott

Technology related to adaptive temporal resource binding based on speculative pipeline interdependency is disclosed. In one example, a key is generated based on contents of a data item (such as a network packet received via a computer network). The key is used to determine whether another data item associated with the key is in a processing pipeline, of a plurality of processing pipelines. If another data item associated with the key is in one of the processing pipelines, then the data item is sent to that processing pipeline. If no other data item associated with the key is in any of the processing pipelines, the data item is sent based on available capacities of the processing pipelines. Subsequent data items associated with the same key are sent to the same pipeline so long as at least one data item associated with the key is still in the processing pipeline.

Adaptive temporal resource binding based on speculative pipeline interdependency

Technology related to application deployment across network devices including smart network interface cards. In one example, a method includes distributing an application across a plurality of locally connected computing subdomains. The subdomains can include a mixture of general and special purpose computing subdomains, such as for example, a main computer and an associated smart network interface devices or systems, such as for example a smart network interface card (NIC). The subdomains can each run hypervisors that are bridged to allow a single virtual machine to operate across the subdomains. The application can include multiple portions. For example, an application can be split by different functionalities. The application portions can be tagged to indicate which subdomain they are to be executed within. If the chosen subdomain has available the requisite resources, the application can be detached and distributed to the chosen subdomain.

Methods for application deployment across multiple computing domains and devices thereof

Technology related to broadcast packet direct memory access (DMA) operations is disclosed. When a network interface controller (NIC) connected to a host computer receives a broadcast packet, it can transmit a request to an agent process running on the host computer for a plurality of destination buffers. In some embodiments, the request to the agent comprises all or part of the packet, or metadata about the packet. In such embodiments, the agent can use the contents of the request to identify services that should receive the packet. Alternatively, the NIC can identify the destination services and can transmit identifiers for the destination services to the agent. The agent can transmit requests for memory buffers to the services and can receive memory location identifiers in response. The agent can transmit the identifiers to the NIC, which can perform multiple DMA operations to write the broadcast packet to the identified memory locations.

Multi-destination DMA for packet broadcast

Technology related to orchestrating a configuration of a programmable accelerator is disclosed. In one example, a method includes executing a service within a container runtime. The service can include a software application and an orchestrator application, where the orchestrator application is adapted to configure a programmable hardware accelerator and the software application adapted to interoperate with the programmable hardware accelerator. The orchestrator application, executing within the container runtime, can be used to retrieve a system image from a file repository. The system image can include configuration data for the programmable hardware accelerator. The orchestrator application, executing within the container runtime, can be used to configure the programmable hardware accelerator.

Orchestrating configuration of a programmable accelerator

Technology related to scheduling services on a platform including configurable computing resources is disclosed. In one example, a method includes scheduling a service to execute on a first computing node based on an availability of general-purpose computing resources at the first computing node. The first computing node can be selected from a plurality of computing nodes. Network traffic transiting the first computing node can be analyzed during the execution of the service to determine a hardware accelerator of a second computing node is capable of assisting the execution of the service. The service can be scheduled to execute on the second computing node and the hardware accelerator of the second computing node can be used to assist with the execution of the service.

Scheduling services on a platform including configurable resources

Methods, non-transitory computer readable media, network traffic management apparatuses, and network traffic management systems that utilize a reverse tunnel proxy in a cloud environment. The reverse tunnel proxy in a cloud environment automatically discovers its environment and creates an appropriate tunnel without using a public IP. The reverse tunnel proxy in a cloud environment utilizes an outgoing connection along with an initialization and channelization to connect to the cloud and accepts an incoming connection in response. In embodiments, a cloud initiates a connection and a tunnel is created without need for additional IP addresses. In embodiments, the reverse tunnel proxy in a cloud environment connects to a client as a server and a private key is stored at a server side without pushing private keys into a public environment.

Methods and devices for service-discovering reverse-tunnel proxy and tunnel service center

Technology related to scheduling services on a platform including configurable computing resources is disclosed. In one example, a method includes scheduling a first service to execute on a computing node based on an availability of general-purpose computing resources at the computing node. The computing node can be selected from a plurality of computing nodes. Network traffic transiting the computing node can be analyzed during the execution of the first service to determine a hardware accelerator of the computing node is capable of assisting the execution of the first service. The hardware accelerator can be used to assist with the execution of the first service. A second service can be scheduled on the computing node based on the availability of the general-purpose computing resources and the usage of the hardware accelerator on the computing node.

The disclosed technology includes accessing a first network application programming interface exposed by a first cloud provider of the plurality of cloud providers to identify a first pricing profile, the first pricing profile associated with the first Cloud provider. Upon identifying the first pricing profile, accessing a second network application programming interface exposed by a second cloud provider of the plurality of cloud providers to identify a second pricing profile, the second pricing profile associated with the second Cloud provider. A load balancing decision is determined comparing the identified first pricing profile with the identified second pricing profile. Next, the determined load balancing decision is executed on a monitored computing-traffic.

Methods for server load balancing in a cloud environment using dynamic cloud pricing and devices thereof

Embodiments are directed towards improving the performance of network traffic management devices by optimizing the management of hot connection flows. A packet traffic management device ('PTMD') may employ a data flow segment ('DFS') and control segment (&#x201c;CS&#x201d;). The CS may perform high-level control functions and per-flow policy enforcement for connection flows maintained at the DFS, while the DFS may perform statistics gathering, per-packet policy enforcement (e.g., packet address translations), or the like, on connection flows maintained at the DFS. The DFS may include high-speed flow caches and other high-speed components that may be comprised of high-performance computer memory. Making efficient use of the high speed flow cache capacity may be improved by maximizing the number of hot connection flows and minimizing the number of malicious and/or in-operative connections flows (e.g., non-genuine flows) that may have flow control data stored in the high-speed flow cache.

Data flow segment optimized for hot flows

Embodiments are directed towards network address based flood attack mitigation methods. A PTMD disposed between one or more computers may monitor several network flows and generate metrics associated with malicious network activity, such as, flood attacks. If flood attacks are determined to be occurring, the PTMD may determine the network addresses targeted by the flood attack. Further, the PTMD may activate flood attack mitigation procedures for the targeted network addresses such that other network addresses associated with the monitored network flows are excluded from the flood attack mitigation procedure. The PTMD may monitor the network traffic subsequently communicated to the targeted network addresses. Accordingly, the PTMD may determine if the flood attack has ceased based on characteristics of the monitored network traffic. If the flood attack has ceased, the flood attack mitigation procedures for the targeted network addresses may be deactivated.

Systems and methods for network destination based flood attack mitigation

Embodiments are directed towards improving the performance of network traffic management devices by optimizing the management of hot connection flows. A packet traffic management device ('PTMD') employs a data flow segment ('DFS') and control segment (&#x201c;CS&#x201d;). The CS performs high-level control functions and per-flow policy enforcement for connection flows maintained at the DFS, while the DFS performs statistics gathering, and per-packet policy enforcement, on connection flows maintained at the DFS. The DFS may include high-speed flow caches and other high-speed components. Making efficient use of the high speed flow cache capacity may be improved by maximizing the number of hot connection flows based on unique service and network traffic characteristics through adaptive feedback pattern learning together with administrator configurable service preferences that may have flow control data for most bandwidth hungry and desired hot services offloaded to the high-speed flow cache, at appropriate time.

Hot service flow hardware offloads based on service priority and resource usage

Embodiments are directed towards employing a packet traffic management device that has a split data flow segment ('DFS') and control segment ('CS') to determine if a connection flow update provided by the DFS to the CS is valid. The CS may be utilized to establish connection flows at the DFS based on connection flow requests. The CS may generate a connection flow identifier (&#x201c;CFID&#x201d;) for a connection flow request. The CS may cache the CFID at the CS. The CS may establish a connection flow at the DFS based at least on the connection flow request and the CFID. After a connection flow is established, a DFS may provide a connection flow update and a corresponding CFID to the CS. The CS may determine that the connection flow update is valid if the corresponding CFID matches the CFID cached at the CS.

Minimize recycle SYN issues for split TCP hot flows to improve system reliability and performance

A method performed by a hypervisor in a virtual network traffic management cluster, the method comprising: assigning a set of continuous available source media access control (SMAC) addresses to one or more virtual network traffic management devices in a network traffic management cluster, the one or more virtual network traffic management devices configured to handle connections for virtual guest instances; assigning a region of predetermined size in a SMAC-index mapping table to a corresponding virtual network traffic management device; wherein the assigned SMAC addresses and assigned region in the SMAC-index mapping table are accessible by the virtual guest instances; and maintaining SMAC-index pool allocation to virtual guest instances handled by corresponding virtual network traffic management devices.

Growing community of inventors

Greenacres, WA, United States of America

Timothy Scott Michels