Full data link bypass
    1.
    发明授权
    Full data link bypass 有权
    全数据链路旁路

    公开(公告)号:US07515596B2

    公开(公告)日:2009-04-07

    申请号:US11480069

    申请日:2006-06-30

    IPC分类号: H04L12/28 H04L12/66

    摘要: A system for processing a packet, including a network interface card (NIC), including a plurality of hardware receive rings, a classifier configured to classify the packet and send the packet to one of the plurality of hardware receive rings, and a host, operatively connected to the NIC, including a virtual network stack including a virtual serialization queue, a virtual network interface card (VNIC) associated with the virtual serialization queue, a device driver associated with the VNIC and configured to store a function pointer and a token associated with one of the plurality of hardware receive rings, where the VNIC is configured to perform at least one selected from a group consisting of enabling bypass mode and disabling bypass mode by changing the function pointer stored in the device driver, where the function pointer is used to send the packet to the virtual serialization queue if the bypass mode is enabled.

    摘要翻译: 一种用于处理分组的系统,包括包括多个硬件接收环的网络接口卡(NIC),分类器,被配置为对分组进行分类,并将分组发送到多个硬件接收环中的一个,以及主机,可操作地 连接到所述NIC,包括虚拟网络栈,包括虚拟序列化队列,与所述虚拟序列化队列相关联的虚拟网络接口卡(VNIC);与所述VNIC相关联并被配置为存储与所述虚拟序列化队列相关联的功能指针和令牌的令牌 多个硬件接收环之一,其中VNIC被配置为执行从由启用旁路模式和禁用旁路模式组成的组中选择的至少一个,其中,通过改变存储在设备驱动器中的功能指针,其中使用功能指针 如果启用旁路模式,则将数据包发送到虚拟序列化队列。

    Method and system for enforcing security policies on network traffic
    2.
    发明授权
    Method and system for enforcing security policies on network traffic 有权
    执行网络流量安全策略的方法和系统

    公开(公告)号:US09059965B2

    公开(公告)日:2015-06-16

    申请号:US12494910

    申请日:2009-06-30

    IPC分类号: G06F9/00 H04L29/06

    CPC分类号: H04L63/0227

    摘要: A computer readable medium that includes computer readable program code embodied therein. The computer readable medium causes the computer system to receive, by a data link rule enforcer, a packet from a packet source of the packets, and obtain a data link rule applying to a data link. The data link is operatively connected to the packet source, and the data link is associated with a media access control (MAC) address. The computer readable medium further causes the computer system to determine, by the data link rule enforcer, whether the packet complies with the data link rule, and drop, by the data link rule enforcer, the packet when the packet fails to comply with the data link rule.

    摘要翻译: 一种计算机可读介质,包括其中体现的计算机可读程序代码。 计算机可读介质使得计算机系统通过数据链路规则执行器从分组的分组源接收分组,并获得应用于数据链路的数据链路规则。 数据链路可操作地连接到分组源,并且数据链路与媒体访问控制(MAC)地址相关联。 计算机可读介质还使得计算机系统通过数据链路规则执行器确定分组是否符合数据链路规则,并且在分组不符合数据时由数据链路规则执行器丢弃分组 链接规则。

    METHOD AND SYSTEM FOR ENFORCING SECURITY POLICIES ON NETWORK TRAFFIC
    3.
    发明申请
    METHOD AND SYSTEM FOR ENFORCING SECURITY POLICIES ON NETWORK TRAFFIC 有权
    执行网络交通安全政策的方法和系统

    公开(公告)号:US20100333189A1

    公开(公告)日:2010-12-30

    申请号:US12494910

    申请日:2009-06-30

    IPC分类号: G06F9/00

    CPC分类号: H04L63/0227

    摘要: A computer readable medium that includes computer readable program code embodied therein. The computer readable medium causes the computer system to receive, by a data link rule enforcer, a packet from a packet source of the packets, and obtain a data link rule applying to a data link. The data link is operatively connected to the packet source, and the data link is associated with a media access control (MAC) address. The computer readable medium further causes the computer system to determine, by the data link rule enforcer, whether the packet complies with the data link rule, and drop, by the data link rule enforcer, the packet when the packet fails to comply with the data link rule.

    摘要翻译: 一种计算机可读介质,包括其中体现的计算机可读程序代码。 计算机可读介质使得计算机系统通过数据链路规则执行器从分组的分组源接收分组,并获得应用于数据链路的数据链路规则。 数据链路可操作地连接到分组源,并且数据链路与媒体访问控制(MAC)地址相关联。 计算机可读介质还使得计算机系统通过数据链路规则执行器确定分组是否符合数据链路规则,并且在分组不符合数据时由数据链路规则执行器丢弃分组 链接规则。

    Assigning higher priority to transactions based on subscription level
    4.
    发明授权
    Assigning higher priority to transactions based on subscription level 有权
    根据订阅级别为交易分配更高的优先级

    公开(公告)号:US07591011B1

    公开(公告)日:2009-09-15

    申请号:US11112947

    申请日:2005-04-22

    IPC分类号: G06F9/00 G06F15/16 G06F17/00

    CPC分类号: H04L12/4641

    摘要: A computing system is configured to receive incoming packets at a first priority designated for use when receiving packets that are not associated with specific subscription levels. Incoming packets are examined to determine whether they are associated with a particular subscription level. Responsive to a determination that a given packet received over a particular connection is associated with a particular subscription level, the computing system is reconfigured to process packets subsequently received over the same connection at a different priority associated with the particular subscription level.

    摘要翻译: 计算系统被配置为当接收到与特定订阅级别不相关联的分组时,以指定用于的第一优先级接收输入分组。 检查进入的分组以确定它们是否与特定订阅级别相关联。 响应于通过特定连接接收到的给定分组与特定订阅级别相关联的确定,计算系统被重新配置为处理随后在与特定订阅级别相关联的不同优先级在相同连接上接收的分组。

    Method and apparatus for processing network traffic associated with specific protocols
    5.
    发明授权
    Method and apparatus for processing network traffic associated with specific protocols 有权
    用于处理与特定协议相关联的网络流量的方法和装置

    公开(公告)号:US07675920B1

    公开(公告)日:2010-03-09

    申请号:US11112228

    申请日:2005-04-22

    IPC分类号: H04L12/28

    CPC分类号: H04L49/60 H04L69/18 H04L69/22

    摘要: A system that includes a network interface for receiving a packets from a network, a classifier operatively connected to the network interface that analyzes each of the packets and determines to which temporary data structure to forward each of packets, wherein the classifier analyzes each packet to determine with which of a plurality of protocols the packet is associated with. Each temporary data structure within the system is configured to receive packets from the classifier, wherein each of the temporary data structures is associated with at least one virtual serialization queue and wherein each of the temporary data structures is configured to store packets associated with at least one of the plurality of protocols. The at least one virtual serialization queue is configured to queue packets from the one of the temporary data structures associated with the at least one virtual serialization queue.

    摘要翻译: 一种包括用于从网络接收分组的网络接口的系统,可操作地连接到网络接口的分类器,其分析每个分组并确定哪个临时数据结构转发每个分组,其中分类器分析每个分组以确定 分组与多个协议中的哪一个相关联。 系统中的每个临时数据结构被配置为从分类器接收分组,其中每个临时数据结构与至少一个虚拟序列化队列相关联,并且其中每个临时数据结构被配置为存储与至少一个 的多个协议。 所述至少一个虚拟序列化队列被配置为对与所述至少一个虚拟序列化队列相关联的所述临时数据结构之一进行队列的队列进行排队。

    Full data link bypass
    6.
    发明申请
    Full data link bypass 有权
    全数据链路旁路

    公开(公告)号:US20080002731A1

    公开(公告)日:2008-01-03

    申请号:US11480069

    申请日:2006-06-30

    IPC分类号: H04L12/56 H04L12/66

    摘要: A system for processing a packet, including a network interface card (NIC), including a plurality of hardware receive rings, a classifier configured to classify the packet and send the packet to one of the plurality of hardware receive rings, and a host, operatively connected to the NIC, including a virtual network stack including a virtual serialization queue, a virtual network interface card (VNIC) associated with the virtual serialization queue, a device driver associated with the VNIC and configured to store a function pointer and a token associated with one of the plurality of hardware receive rings, where the VNIC is configured to perform at least one selected from a group consisting of enabling bypass mode and disabling bypass mode by changing the function pointer stored in the device driver, where the function pointer is used to send the packet to the virtual serialization queue if the bypass mode is enabled.

    摘要翻译: 一种用于处理分组的系统,包括包括多个硬件接收环的网络接口卡(NIC),分类器,被配置为对分组进行分类,并将分组发送到多个硬件接收环中的一个,以及主机,可操作地 连接到所述NIC,包括虚拟网络栈,包括虚拟序列化队列,与所述虚拟序列化队列相关联的虚拟网络接口卡(VNIC);与所述VNIC相关联并被配置为存储与所述虚拟序列化队列相关联的功能指针和令牌的令牌 多个硬件接收环之一,其中VNIC被配置为执行从由启用旁路模式和禁用旁路模式组成的组中选择的至少一个,其中,通过改变存储在设备驱动器中的功能指针,其中使用功能指针 如果启用旁路模式,则将数据包发送到虚拟序列化队列。

    Method and system for transferring packets to a guest operating system
    7.
    发明授权
    Method and system for transferring packets to a guest operating system 有权
    将数据包传送到客户机操作系统的方法和系统

    公开(公告)号:US08886838B2

    公开(公告)日:2014-11-11

    申请号:US12040101

    申请日:2008-02-29

    IPC分类号: G06F15/16 H04L12/46

    CPC分类号: H04L12/4641

    摘要: In general, the invention relates to a method for transferring a packet. The method includes receiving the packet by a physical network interface, determining a virtual network interface card (VNIC) using a virtual switching table, where the VNIC is located on a computer operatively connected to the network express manager (NEM) via a chassis interconnect, and the VNIC is executing on a host operating system (OS) in the computer. The method further includes transferring the packet to a receive ring (RR) associated with the VNIC, wherein the RR is located on the NEM, providing the network express manager with a receive descriptor, transferring the packet to the guest OS memory using the receive descriptor, and notifying the guest OS that the packet is in the guest OS memory.

    摘要翻译: 通常,本发明涉及一种用于传送分组的方法。 该方法包括:通过物理网络接口接收分组,使用虚拟交换表确定虚拟网络接口卡(VNIC),其中VNIC位于经由机箱互连可操作地连接到网络快速管理器(NEM)的计算机上, 并且VNIC正在计算机中的主机操作系统(OS)上执行。 该方法还包括将分组传送到与VNIC相关联的接收环(RR),其中RR位于NEM上,向网络快速管理器提供接收描述符,使用接收描述符将分组传送到客户OS存储器 ,并通知客户机该数据包在客户机OS存储器中。

    Method and apparatus for defending against denial of service attacks
    8.
    发明授权
    Method and apparatus for defending against denial of service attacks 有权
    防止拒绝服务攻击的方法和装置

    公开(公告)号:US08635284B1

    公开(公告)日:2014-01-21

    申请号:US11255366

    申请日:2005-10-21

    IPC分类号: G06F15/16 H04L29/06 G06F11/30

    摘要: A method for processing packets that includes receiving a packet from a network, analyzing the packet to obtain packet information used to determine to which temporary data structure to forward the packet, if a first list includes the packet information forwarding the packet to a first temporary data structure, and processing the packet from the first temporary data structure, and if the first list does not include the packet information forwarding the packet to a second temporary data structure, processing the packet, wherein processing the packet comprises: sending a first test to a source of the packet using the packet information, placing the packet information on the first list, if a successful response to the first test is received, and placing the packet information on a second list, if an unsuccessful response to the first test is received.

    摘要翻译: 一种处理分组的方法,包括从网络接收分组,如果第一列表包括将分组转发到第一临时数据的分组信息,则分析分组以获得用于确定哪个临时数据结构转发分组的分组信息 结构,并且处理来自第一临时数据结构的分组,并且如果第一列表不包括将分组转发到第二临时数据结构的分组信息,则处理分组,其中处理分组包括:向第一临时数据结构发送第一测试 如果接收到对第一测试的成功响应,则将分组信息放置在第一列表上,并且如果接收到对第一测试的不成功的响应,则将分组信息放置在第二列表上。

    Host operating system bypass for packets destined for a virtual machine
    9.
    发明授权
    Host operating system bypass for packets destined for a virtual machine 有权
    主机操作系统绕过去往虚拟机的数据包

    公开(公告)号:US08005022B2

    公开(公告)日:2011-08-23

    申请号:US11489943

    申请日:2006-07-20

    IPC分类号: H04L12/28

    CPC分类号: H04L12/4641

    摘要: A method for processing packets that includes receiving a first packet for a first virtual machine by a network interface card (NIC), classifying the first packet using a hardware classifier, where the hardware classifier is located on the NIC, sending the first packet to a first one of a plurality of receive rings based on the classification, sending the first packet from the first one of the plurality of receive rings to a first virtual network interface card (VNIC), sending the first packet from the first VNIC to a first interface, and sending the first packet from the first interface to the first virtual machine, where the first virtual machine is associated with the first interface, where the first VNIC and the first virtual machine are executing on a host.

    摘要翻译: 一种处理分组的方法,包括通过网络接口卡(NIC)接收第一虚拟机的第一分组,使用硬件分类器对硬件分类器进行分类,其中硬件分类器位于NIC上,将第一分组发送到 将第一分组从多个接收环中的第一个发送到第一虚拟网络接口卡(VNIC),将第一分组从第一VNIC发送到第一接口 以及将所述第一分组从所述第一接口发送到所述第一虚拟机,其中所述第一虚拟机与所述第一接口相关联,其中所述第一VNIC和所述第一虚拟机在主机上执行。

    UPPER LAYER BASED DYNAMIC HARDWARE TRANSMIT DESCRIPTOR RECLAIMING
    10.
    发明申请
    UPPER LAYER BASED DYNAMIC HARDWARE TRANSMIT DESCRIPTOR RECLAIMING 有权
    基于上层动态硬件传输描述符重新生成

    公开(公告)号:US20100329259A1

    公开(公告)日:2010-12-30

    申请号:US12495386

    申请日:2009-06-30

    IPC分类号: H04L12/56

    CPC分类号: H04L47/10 G06F9/45533

    摘要: In general, the invention relates to reclaiming transmit descriptors by configuring a media access control (MAC) to execute a first MAC layer thread to reclaim a first number of transmit descriptors (TDs) from a first hardware transmit ring (HTR) using a first reclaim algorithm, where the first reclaim algorithm is associated with a first transmission pattern and a first TDR status. The invention further includes receiving, by a virtual NIC (VNIC) executing within the MAC layer, a first number of packets, forwarding the first number of packets to a device driver on the host associated with the physical NIC, and forwarding the first number of packets from the device driver to the physical NIC using the first number of TDs, where the first plurality of TDs are reclaimed by the first MAC layer thread according to the first reclaim algorithm.

    摘要翻译: 通常,本发明涉及通过配置媒体访问控制(MAC)来执行第一MAC层线程以从第一硬件传送环(HTR)使用第一回收来回收第一数量的发送描述符(TD)来回收传输描述符 算法,其中第一回收算法与第一传输模式和第一TDR状态相关联。 本发明还包括通过在MAC层内执行的虚拟NIC(VNIC)接收第一数量的分组,将第一数量的分组转发到与物理NIC相关联的主机上的设备驱动器,并且转发第一数量的 使用第一数量的TD从设备驱动程序到物理NIC的数据包,其中根据第一回收算法由第一MAC层线程回收第一多个TD。