F5 Networks, Inc.

F5, Inc.

William Ross Baumann

Timothy Scott Michels

Paul Imre Szabo

Hao Cai

Alan B Mimms

Lars Pierson Friend

Anthony King

Saul Lewites

Jonathan Mini Hawthorne

Joel Benjamin Moses

Antonio Torzillo

Steven D Dabell

Wei Qian

Ning Kai Chen

James Arthur Thomson

Timothy S Michel

Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with network packet switching based on packet data includes receiving a plurality of network packets. Next, header data and payload data is separated for each of the plurality of received network packets. Next, digest data is created from the separated header data for each of the plurality of network packets. One or more network actions are identified for each of the plurality of network packets based on the corresponding created digest data. The identified one or more network actions are performed on the separated header data and the payload data.

Methods for switching network packets based on packet data and devices

Methods, non-transitory computer readable media, network traffic management apparatuses, and network traffic management systems include inspecting a plurality of incoming packets to obtain packet header data for each of the incoming packets. The packet header data is filtered using one or more filtering criteria. At least one of a plurality of optimized DMA behavior mechanisms for each of the incoming packets are selected based on associating the filtered header data for each of the incoming packets with stored profile data. The incoming packets are disaggregated based on the corresponding selected one of the optimized DMA behavior mechanisms.

Methods for traffic dependent direct memory access optimization and devices thereof

Technology related to scheduling services on a platform including configurable computing resources is disclosed. In one example, a method includes scheduling a service to execute on a first computing node based on an availability of general-purpose computing resources at the first computing node. The first computing node can be selected from a plurality of computing nodes. Network traffic transiting the first computing node can be analyzed during the execution of the service to determine a hardware accelerator of a second computing node is capable of assisting the execution of the service. The service can be scheduled to execute on the second computing node and the hardware accelerator of the second computing node can be used to assist with the execution of the service.

Scheduling services on a platform including configurable resources

Methods, non-transitory computer readable media, network traffic management apparatuses, and network traffic management systems that utilize a reverse tunnel proxy in a cloud environment. The reverse tunnel proxy in a cloud environment automatically discovers its environment and creates an appropriate tunnel without using a public IP. The reverse tunnel proxy in a cloud environment utilizes an outgoing connection along with an initialization and channelization to connect to the cloud and accepts an incoming connection in response. In embodiments, a cloud initiates a connection and a tunnel is created without need for additional IP addresses. In embodiments, the reverse tunnel proxy in a cloud environment connects to a client as a server and a private key is stored at a server side without pushing private keys into a public environment.

Methods and devices for service-discovering reverse-tunnel proxy and tunnel service center

Technology related to disaggregating network traffic is disclosed. In one example, a method can include determining whether individual network flows are members within a first subset of the network flows. A second subset of the first subset of network flows can be learned in response to determining a change in a number of servers available to service the network flows. A first network packet can be forwarded to a first server in response to the first network packet being a member of the first subset of network flows and a member of the learned second subset of the first subset of network flows. A second network packet can be forwarded to a second server in response to the second network packet being a member of the first subset of network flows but not a member of the learned second subset of the first subset of network flows.

Disaggregation of network traffic

Technology related to scheduling services on a platform including configurable computing resources is disclosed. In one example, a method includes scheduling a first service to execute on a computing node based on an availability of general-purpose computing resources at the computing node. The computing node can be selected from a plurality of computing nodes. Network traffic transiting the computing node can be analyzed during the execution of the first service to determine a hardware accelerator of the computing node is capable of assisting the execution of the first service. The hardware accelerator can be used to assist with the execution of the first service. A second service can be scheduled on the computing node based on the availability of the general-purpose computing resources and the usage of the hardware accelerator on the computing node.

Embodiments are directed towards overprovisioning IP addresses among a plurality of traffic management devices (TMDs). A plurality of IP addresses may be distributed among a plurality of available TMDs. A corresponding mirror TMD may be determined for each IP address. The corresponding mirror TMD for an IP address may be different than the available TMD currently associated with the IP address. In various embodiments, connections associated with each IP address may be mirrored at their corresponding mirror TMDs. The available TMDs may be employed to perform traffic management tasks on received packets based on at least a destination IP address of the received packets and the IP addresses associated with the available TMDs. If a TMD becomes unavailable, the IP addresses associated with the unavailable TMD may be redistributed to at least one remaining available TMD.

Overprovisioning floating IP addresses to provide stateful ECMP for traffic groups

Embodiments are directed towards network address based flood attack mitigation methods. A PTMD disposed between one or more computers may monitor several network flows and generate metrics associated with malicious network activity, such as, flood attacks. If flood attacks are determined to be occurring, the PTMD may determine the network addresses targeted by the flood attack. Further, the PTMD may activate flood attack mitigation procedures for the targeted network addresses such that other network addresses associated with the monitored network flows are excluded from the flood attack mitigation procedure. The PTMD may monitor the network traffic subsequently communicated to the targeted network addresses. Accordingly, the PTMD may determine if the flood attack has ceased based on characteristics of the monitored network traffic. If the flood attack has ceased, the flood attack mitigation procedures for the targeted network addresses may be deactivated.

Systems and methods for network destination based flood attack mitigation

Creating a connection between one of a first plurality of computing devices in a primary chassis and one of a second plurality of computing devices in a failover chassis. A first plurality of buckets may be associated with the primary chassis, a second plurality of buckets may be associated with the failover chassis, where the first plurality of buckets may correspond to the second plurality of buckets. One of the first plurality of computing devices may be associated with one of the first plurality of buckets, and can create a connection with attributes such that a disaggregator in the failover chassis routes the connection to one of the second plurality of computing devices, wherein the one of the second plurality of computing devices may be associated with a bucket of the second plurality of buckets that corresponds to the one of the first plurality of buckets.

Connection bucketing in mirroring asymmetric clustered multiprocessor systems

A system, method and medium is disclosed which includes selecting, at a software component of a network traffic management device, a first bucket having a first predetermined transmit time. The disclosure includes populating one or more selected data packet descriptors associated with one or more corresponding data packets in the first bucket. The disclosure includes releasing the first bucket to a hardware component of the network traffic management device, wherein the hardware component processes the one or more data packet descriptors of the first bucket for the first predetermined transmit time.

Transmit rate pacing of large network traffic bursts to reduce jitter, buffer overrun, wasted bandwidth, and retransmissions

A method and system for efficient direct DMA for processing connection state information or other expediting data packets. One example is the use of a network interface controller to buffer TCP type data packets that may contain connection state information. The connection state information is extracted from a received packet. The connection state information is stored in a special DMA descriptor that is stored in a ring buffer area of a buffer memory that is accessible by a host processor when an interrupt signal is received. The packet is then discarded. The host processor accesses the ring buffer memory only to retrieve the stored connection state information from the DMA descriptor without having to access a packet buffer area in the memory.

Methods and systems for providing direct DMA

A method, non-transitory computer readable medium, and a system for communicating with networked clients and servers through a network device includes receiving a first network data packet destined for a first executing traffic management application of a plurality of executing traffic management applications operating in the network device. A first DMA channel is identified to allocate the received first network data packet. Further, the first network data packet is transmitted to the first traffic management executing application over the first identified DMA channel.

Network devices with multiple direct memory access channels and methods thereof

A system and method of idle driven scheduling in a network device is disclosed. An interrupt signal is received from a timer, wherein a network processing component of a network device awakes from sleep mode of a first sleep duration for a first cycle upon receiving the interrupt signal. Load information of a computer processing unit in the network device for the first cycle is determined. A second sleep duration is selected for the network processing component in a second cycle based on the load information, wherein the second sleep duration is different from the first sleep duration. The timer is then instructed to send the interrupt signal to the network processing component at an expiration of the second sleep duration.

Systems and methods for idle driven scheduling

A method, computer readable medium, and system for handling network packets at an application delivery controller includes receiving a packet from a communication network at a network interface controller within the application delivery controller and associating the received packet with a logical interface selected from a plurality of logical interfaces in at least one processing system using a mapping engine at the network interface controller, where each of the plurality of logical interfaces associated with a different physical address. At the network interface controller a physical address is assigned to the received packet corresponding to the selected logical interface to which data in the received packet is to be sent and a virtual address associated with the physical address in the network interface controller is retrieved. Data in the received packet and the retrieved virtual address is transmitted to the at least one processing system.

Growing community of inventors

Seattle, WA, United States of America

William Ross Baumann