An intelligent network interface card (INIC) or communication processing device (CPD) works with a host computer for data communication. The device provides a fast-path that avoids protocol processing for most messages, greatly accelerating data transfer and offloading time-intensive processing tasks from the host CPU. The host retains a fallback processing capability for messages that do not fit fast-path criteria, with the device providing assistance such as validation even for slow-path messages, and messages being selected for either fast-path or slow-path processing. A context for a connection is defined that allows the device to move data, free of headers, directly to or from a destination or source in the host. The context can be passed back to the host for message processing by the host. The device contains specialized hardware circuits that are much faster at their specific tasks than a general purpose CPU. A preferred embodiment includes a trio of pipelined processors devoted to transmit, receive and utility processing, providing full duplex communication for four Fast Ethernet nodes.

TCP/IP offload network interface device

A system for protocol processing in a computer network has an intelligent network interface card (INIC) or communication processing device (CPD) associated with a host computer. The INIC provides a fast-path that avoids protocol processing for most large multi-packet messages, greatly accelerating data communication. The INIC also assists the host for those message packets that are chosen for processing by host software layers. A communication control block for a message is defined that allows DMA controllers of the INIC to move data, free of headers, directly to or from a destination or source in the host. The context is stored in the INIC as a communication control block (CCB) that can be passed back to the host for message processing by the host. The INIC contains specialized hardware circuits that are much faster at their specific tasks than a general purpose CPU. A preferred embodiment includes a trio of pipelined processors with separate processors devoted to transmit, receive and management processing, with full duplex communication for four fast Ethernet nodes.

Fast-path apparatus for receiving data corresponding to a TCP connection

A system within a computer network identifies specific traffic flows originating from a given network entity and requests and applies appropriate policy rules or service treatments to the traffic flows. A network entity includes a flow declaration component that communicates with one or more application programs executing on the entity. The flow declaration component includes a message generator and an associated memory for storing one or more traffic flow data structures. For a given traffic flow, the application program issues one or more calls to the flow declaration component providing it with information identifying the traffic flows. The flow declaration component then opens a flow management session with a local policy enforcer that obtains policy rules or service treatments for the identified flow from a policy server and applies those rules or treatments to the specific traffic flows from the network entity.

Method and apparatus for identifying network data traffic flows and for applying quality of service treatments to the flows

A router for use in a network includes a scalable architecture and performs methods for implementing quality of service on a logical unit behind a network port; and for implementing storage virtualization. The architecture includes a managing processor, a supervising processor; and a plurality of routing processors coupled to a fabric. The managing processor has an in-band link to a routing processor. A routing processor receives a frame from the network, determines by parsing the frame, the protocol and logical unit number, and routes the frame to a queue according to a traffic class associated with the logical unit number in routing information prepared for the processors. An arbitration scheme empties the queue in accordance with a deficit round robin technique. If a routing processor detects the frame's destination is a virtual entity, and so is part of a virtual transaction, the router conducts a nonvirtual transaction in concert with the virtual transaction. The nonvirtual transaction accomplishes the intent of the virtual transaction but operates on an actual network port, for example, a storage device.

Router with routing processors and methods for virtualization

Systems and methods for detecting and preventing network security breaches are described. The systems and methods present a gateway-based packet-forwarding network security solution to not only detect security breaches but also prevent them by directly dropping suspicious packets and connections. The systems and methods employ multiple techniques to detect and prevent network security breaches, including stateful signature detection, traffic signature detection, and protocol anomaly detection.

Multi-method gateway-based network security systems and methods

The present invention relates to a general-purpose programmable packet-processing platform for accelerating network infrastructure applications which have been structured so as to separate the stages of classification and action. Network packet classification, execution of actions upon those packets, management of buffer flow, encryption services, and management of Network Interface Controllers are accelerated through the use of a multiplicity of specialized modules. A language interface is defined for specifying both stateless and stateful classification of packets and to associate actions with classification results in order to efficiently utilize these specialized modules.

Packet processing system including a policy engine having a classification unit

Programmable system for processing a partitioned network infrastructure

Methods and apparatus relating to a tightly coupled scalar and Boolean processor are described. In an embodiment, a Boolean unit may include a result vector subunit. The result vector subunit may be controlled by an instruction flow that is managed by a scalar unit. Other embodiments are also disclosed.

Tightly coupled scalar and boolean processor

A method and apparatus for translating a virtual address to a physical address. A virtual address to be translated has a virtual page offset and a virtual page number. The virtual address to be translated addresses a page of memory. The size of this page is unknown. There are L different possible page sizes where L is a positive integer greater than one. Each of the L different page sizes is selected to be a test page size and a test is performed. During the test, a pointer into a translation storage buffer is calculated. The pointer is calculated from the virtual address to be translated by assuming that the virtual address to be translated corresponds to a mapping of the test page size. The pointer points to a candidate translation table entry of the translation storage buffer. The candidate translation table entry has a candidate tag and candidate data. The candidate tag identifies a particular virtual address and the candidate data identifies a particular physical address corresponding to the particular virtual address. A virtual address target tag is extracted from the virtual address to be translated. The virtual address target tag is calculated by assuming that the virtual address to be translated corresponds to a mapping of the test page size. The target tag and the candidate tag are then compared. If the target tag matches the candidate tag, the candidate data is provided as the physical address translation corresponding to the virtual address to be translated.

Virtual address to physical address translation cache that supports multiple page sizes

A method and apparatus for actively managing the overall power consumption of a computer network which includes a plurality of computer systems interconnected to each other. In turn, each computer system has one or more modules. Each computer system of the computer network is capable of independently initiating a transition into a power-conserving mode, i.e., a "sleep" state, while keeping its network interface "alive" and fully operational. Subsequently, each computer system can independently transition back into fully operational state, i.e., an "awake" state, when triggered by either a deterministic or an asynchronous event. As a result, the sleep states of the computer systems are transparent to the computer network. Deterministic events are events triggered internally by a computer system, e.g., an internal timer waking the computer system up at midnight to perform housekeeping chores such as daily tape backups. Conversely, the source of asynchronous events are external in nature and include input/output (I/O) activity. The illusion of the entire network being always fully operational is possible because the system controllers, the interconnects and network interfaces of each computer system remain fully operational while selected modules and peripheral devices are powered down. As a result, each computer system is able to rapidly awake from sleep state in response to stimuli by powering down selected modules thereby accomplishing power conservation without requiring a static shut down of the computer network, i.e., without the overall performance and response of the computer network.

Charles E. Narad

Papers

Packet processing system including a policy engine having a classification unit

Programmable system for processing a partitioned network infrastructure

Tightly coupled scalar and boolean processor

Virtual address to physical address translation cache that supports multiple page sizes

Method and apparatus for reducing power consumption in a computer network without sacrificing performance