Palo Alto Networks, Inc.

Nokia Ip, Inc.

William Alan Roberson

Wilson Xu

Subramani Ganesh

Savitha Raghunath

Sidong Li

Gyanesh Saharia

De Bao Vu

Matthew Robert Rohm

Peter J Newman

Greg Minshall

Eric Hoffman

Fong Ching Liaw

Robert Hinden

Thomas Lyon

Lawrence B Huston

To use larger capacity TCAMs while avoiding various packaging and power management issues of TCAMs, pre-processing can be performed on TCAM lookup requests to intelligently pipeline lookup requests according to a defined power budget that is based on TCAM and power supply specifications. Dividing lookup requests based on a power budget smooths the instantaneous current demand and dynamic power demand. This intelligent pre-processing of lookup requests allows lookup requests that satisfy a power budget based threshold to still complete within a single clock cycle while nominally reducing performance for those lookup requests that would not satisfy the power budget based threshold. When a lookup request will not satisfy the power budget based threshold, the lookup request is split into searches targeting different memory blocks of the TCAM.

Amortizing dissipated power and current demand in a ternary content addressable memory

A security device for processing network flows is described, including: one or more packet processors configured to receive incoming data packets associated with network flows where a packet processor is assigned as an owner of network flows and each packet processor processes data packets associated with flows for which it is the assigned owner; and a packet processing manager configured to assign ownership of network flows to the packet processors where the packet processing manager includes a global flow table containing global flow table entries mapping network flows to packet processor ownership assignments and a predict flow table containing predict flow entries mapping predicted network flows to packet processor ownership assignments. A predict flow entry includes a predict key and associated packet processor ownership assignment. The predict key includes multiple data fields identifying a predicted network flow where one or more of the data fields have a wildcard value.

Security device implementing network flow prediction

A network security device includes a network flow statistics processing engine to process network flow information related to network flows. The network flow statistics processing engine includes a first processing stage performing per-flow information aggregation and a second processing stage performing per-destination system component information aggregation, with each processing stage implementing a threshold-based data export scheme and a timer-based data export scheme. In this manner, up-to-date flow information is available to peer system components regardless of the varying flow rates of the network flow.

Network device implementing two-stage flow information aggregation

A security device for processing network flows includes one or more packet processors configured to receive incoming data packets associated with one or more network flows where a packet processor is assigned as an owner of one or more network flows and each packet processor processes data packets associated with flows for which it is the assigned owner; and a packet processing manager configured to assign ownership of network flows to the one or more packet processors where the packet processing manager includes a global flow table containing entries mapping network flows to packet processor ownership assignments. The packet processing manager informs a packet processor of an ownership assignment after one or more packets are received, and the one or more packet processors learns of ownership assignments of network flows from the packet processing manager.

Flow ownership assignment in a distributed processor system

A method in a security device for processing network flows includes storing local counter values for one or more events and providing global event counters to maintain event statistics for events in the security device. In one embodiment, the method stores local counter value of an event for each packet processor reporting the event in a counter memory and the method sums the local counter values of an event stored in the counter memory to generate the global counter sum value for the event. In another embodiment, the method compares the global counter sum to a threshold value to put the event in a conforming state or non-conforming state. The method sends a multicast message to the interested packet processors indicating an event has transitioned to a non-conforming state.

Event aggregation in a distributed processor system

A security device for processing network flows includes packet processing cards with packet processors formed thereon where each packet processing card stores local counter values for one or more events and a packet processing manager including global event counters to maintain event statistics for events in the security device. In one embodiment, the packet processing manager stores a copy of the local counter value of an event for each packet processor reporting the event in the counter memory and the global event counter provides a global counter sum value for the event by summing the copies of local counter values in the local memory. In another embodiment, the global counter sum is compared to a threshold value to put the event in a conforming state or non-conforming state. The packet processing manager sends a multicast message to the interested packet processors indicating an event has transitioned to a non-conforming state.

A method and apparatus for dynamically shifting between switching and routing packets efficiently to provide high packet throughput. The present invention provides a method for transmitting packets between an upstream node and a downstream node in a network that utilizes flow classification and labelling to redirect flows. The method includes the steps of establishing default virtual channels between the upstream node and the downstream node, receiving a packet at the downstream node, performing a flow classification at the downstream node on the packet to determine whether the packet belongs to a specified flow that should be redirected in the upstream node, selecting a free label at the downstream node, and informing the upstream node that future packets belonging to the specified flow should be sent with the selected free label attached. Other embodiments of the present invention include a basic switching unit, a switch gateway unit, and a switching agent for use in a system for transmitting packets in a network. Another embodiment includes system software, fixed on tangible media, that performs flow classification of packets to enable flow labelling and redirection to dynamically shift between Layer 3 IP packet routing and Layer 2 switching to optimize packet traffic throughput. A further embodiment provides a method for switching a flow at a first node in a network.

Growing community of inventors

Scotts Valley, CA, United States of America

William Alan Roberson