Claims
- 1. An apparatus for identifying a merged lookup result, the apparatus comprising:
a mechanism for generating a lookup value; one or more associative memories for generating a plurality of associative memory results based on the lookup value, the plurality of associative memory results including at least one result from each of said one or more associative memories; a one or more adjunct memories, coupled to said one or more associative memories, for performing lookup operations on said plurality of associative memory results to generate a plurality of lookup results; and a combiner, coupled to said one or more adjunct memories, for merging the plurality of lookup results to generate the merged lookup result.
- 2. The apparatus of claim 1, wherein the plurality of lookup results are each associated with precedence indications stored in said one or more adjunct memories, and
wherein said combiner selects one of the plurality of lookup results as the merged result based on said precedence values of the plurality of lookup results.
- 3. The apparatus of claim 1, wherein each of the plurality of lookup results correspond to a different feature as defined in an access control list.
- 4. A method for identifying a merged lookup result, the method comprising:
identifying an access control list including a plurality of access control list entries; identifying a first set of access control list entries corresponding to a first feature of said plurality of access control list entries; programming a first associative memory bank and a first adjunct memory with first associative memory entries corresponding to the first set of access control list entries identifying a second set of access control list entries corresponding to a first feature of said plurality of access control list entries; and programming a second associative memory bank and a second adjunct memory with second associative memory entries corresponding to the second set of access control list entries; wherein said first associative memory entries have a higher lookup precedence than said second associative memory entries.
- 5. The method of claim 4, comprising:
identifying a lookup value; performing lookup operations in the first associative memory bank and the first adjunct memory to generate a first second lookup result; performing lookup operations in the second associative memory bank and the second adjunct memory to generate a second lookup result; and merging the first and the second lookup results to identify a merged result.
- 6. The method of claim 5, wherein said lookup operations in the first and the second associative memory banks are performed substantially simultaneously.
- 7. The method of claim 5, wherein if the first associate memory result corresponds to a deny operation, the merged result corresponds to a drop packet operation.
- 8. The method of claim 5, wherein if the first associate memory result corresponds to a permit operation and the second associative memory result corresponds to a permit operation, the merged result corresponds to a permit operation.
- 9. The method of claim 5, wherein if the first associate memory result corresponds to a permit operation and the second associative memory result corresponds to a deny operation, the merged result corresponds to a drop packet operation.
- 10. A method for identifying a merged lookup result, the method comprising:
identifying a packet; identify a first lookup value; performing substantially simultaneous lookup operations in a plurality of associative memories and adjunct memories to generate a plurality of first lookup results; merge the plurality of first lookup results to identify a merged first result; identify a second lookup value; performing substantially simultaneous lookup operations in the plurality of associative memories and adjunct memories to generate a plurality of second lookup results; and merge the plurality of second lookup results and the merged first result to identify a merged second result.
- 11. The method of claim 10, each of the plurality of first lookup results correspond to a different feature of a first type as defined in an access control list.
- 12. The method of claim 11, each of the plurality of second lookup results correspond to a different feature of a second type as defined in the access control list.
- 13. The method of claim 12, wherein the first type includes a security operation and the second type includes a quality of service operation.
- 14. The method of claim 10, wherein the first lookup value includes at least one autonomous system number, said at least one autonomous system number identify a set of communication devices under, a single administrative authority
- 15. A computer-readable medium containing computer-executable instructions for performing steps for identifying a merged lookup result, said steps comprising:
identifying an access control list including a plurality of access control list entries; identifying a first set of access control list entries corresponding to a first feature of said plurality of access control list entries; programming a first associative memory bank and a first adjunct memory with first associative memory entries corresponding to the first set of access control list entries identifying a second set of access control list entries corresponding to a first feature of said plurality of access control list entries; and programming a second associative memory bank and a second adjunct memory with second associative memory entries corresponding to the second set of access control list entries; wherein said first associative memory entries have a higher lookup precedence than said second associative memory entries.
- 16. The computer-readable medium of claim 15, wherein said steps comprise:
identifying a lookup value; performing lookup operations in the first associative memory bank and the first adjunct memory to generate a first second lookup result; performing lookup operations in the second associative memory bank and the second adjunct memory to generate a second lookup result; and merging the first and the second lookup results to identify a merged result.
- 17. The computer-readable medium of claim 16, wherein if the first associate memory result corresponds to a deny operation, the merged result corresponds to a drop packet operation.
- 18. The computer-readable medium of claim 16, wherein if the first associate memory result corresponds to a permit operation and the second associative memory result corresponds to a permit operation, the merged result corresponds to a permit operation.
- 19. The computer-readable medium of claim 16, wherein if the first associate memory result corresponds to a permit operation and the second associative memory result corresponds to a deny operation, the merged result corresponds to a drop packet operation.
- 20. An apparatus for identifying a merged lookup result, the apparatus comprising:
means for identifying an access control list including a plurality of access control identifying an access control list including a plurality of access control list entries; means for identifying a first set of access control list entries corresponding to a first feature of said plurality of access control list entries; means for programming a first associative memory bank and a first adjunct memory with first associative memory entries corresponding to the first set of access control list entries means for identifying a second set of access control list entries corresponding to a first feature of said plurality of access control list entries; and means for programming a second associative memory bank and a second adjunct memory with second associative memory entries corresponding to the second set of access control list entries; wherein said first associative memory entries have a higher lookup precedence than said second associative memory entries.
- 21. The apparatus of claim 20, comprising:
means for identifying a lookup value; means for performing lookup operations in the first associative memory bank and the first adjunct memory to generate a first second lookup result; means for performing lookup operations in the second associative memory bank and the second adjunct memory to generate a second lookup result; and means for merging the first and the second lookup results to identify a merged result.
- 22. An apparatus for identifying a merged lookup result, the apparatus comprising:
means for identifying a packet; means for identify a first lookup value; means for performing substantially simultaneous lookup operations in a plurality of associative memories and adjunct memories to generate a plurality of first lookup results; means for merge the plurality of first lookup results to identify a merged first result; means for identify a second lookup value; means for performing substantially simultaneous lookup operations in the plurality of associative memories and adjunct memories to generate a plurality of second lookup results; and means for merge the plurality of second lookup results and the merged first result to identify a merged second result.
- 23. The apparatus of claim 22, wherein:
each of the plurality of first lookup results correspond to a different feature of a first type as defined in an access control list; and each of the plurality of second lookup results correspond to a different feature of a second type as defined in the access control list.
CROSS-REFERENCE TO RELATED APPLICATIONS
[0001] This is a continuation-in-part of application Ser. No. 10/215,719, filed Aug. 10, 2002, and is hereby incorporated by reference.
Continuation in Parts (1)
|
Number |
Date |
Country |
Parent |
10215719 |
Aug 2002 |
US |
Child |
10630174 |
Jul 2003 |
US |